a probabilistic pointer analysis for speculative...

A Probabilistic Pointer Analysis for Speculative Optimization

A Probabilistic Pointer Analysis for Speculative Optimization

Jeff DaSilva Greg SteffanJeff DaSilva Greg Steffan

Electrical and Computer EngineeringUniversity of TorontoToronto, ON, CanadaOct 17th, 2005

Electrical and Computer EngineeringUniversity of TorontoToronto, ON, CanadaOct 17th, 2005

2University Of Toronto

Pointers Impede OptimizationPointers Impede Optimization

Many optimizations come to a halt when they encounter an ambiguous pointer

foo(int *a) {…while(…){

x = *a; …

}}

Loop InvariantCode Motion

Parallelize

Pointer Analysis is Important


Pointer AnalysisPointer Analysis

Do pointers a and b point to the same location?Do this for every pair of pointers at every program point

*a = ~~ = *b

*a = ~ ~ = *b

Definitely Not

Definitely

Maybe

PointerAnalysis

optimize


Pointer analysisPointer analysis is a difficult problemscalablescalable and overly conservativeoverly conservative

failsfails--toto--scalescale and accurateaccurate

Ambiguous pointers will persisteven when using the most accurate accurate of algorithms

output is often unavoidable

What can be done with ?

Pointer Analysis is DifficultPointer Analysis is Difficult

Maybe

Maybe

oror


Lets SpeculateLets Speculate

Compilers make conservativeconservative assumptionsThey must alwaysalways preserve program correctness

“It's easier to apologize than ask for permission.”Author: Anonymous

Implement a potentially unsafeunsafe optimizationVerifyVerify and RecoverRecover if necessary


Speculation applied to PointersSpeculation applied to Pointers

int *a, x;…while(…){

x = *a; …

}

a is probably loop invariant

int *a, x, tmp;…tmp = *a;while(…){

x = tmp; …

} <verify, recover?><verify, recover?>


Data Speculative OptimizationsData Speculative OptimizationsThe EPIC Instruction set

Explicit support for speculative load/store instructions (eg. Itanium)

Speculative compiler transformationsDead store elimination, redundancy elimination, copy propagation, strength reduction, register promotion

Thread-level speculation (TLS) Hardware support for tracking speculative parallel threads

Transactional programmingRollback support for aborted transactions

When to speculate? Techniques rely on profiling


Quantitative Output RequiredQuantitative Output Required

Estimate the potential benefit for speculating:

SPECULATE?

ExpectedExpectedspeedupspeedup(if successful)(if successful)

RecoveryRecoverypenaltypenalty

(if unsuccessful)(if unsuccessful)OverheadOverheadfor verifyfor verify

Probabilistic output neededMaybe

Maybe

Maybe

ProbabilityProbabilityof successof success


Conventional Pointer AnalysisConventional Pointer Analysis

Do pointers a and b point to the same location?Do this for every pair of pointers at every program point

*a = ~~ = *b

*a = ~ ~ = *b

Definitely Not

Definitely

Maybe

PointerAnalysis

optimizeoptimize


*a = ~~ = *b

*a = ~ ~ = *b

optimize

Probabilistic Pointer Analysis Probabilistic Pointer Analysis (PPA)(PPA)

PPApp = 0.0pp = 1.0

0.0 < pp < 1.0

With what probability pp, do pointers a and b point to the same location?

Do this for every pair of pointers at every program point

optimize


PPA Research ObjectivesPPA Research ObjectivesAccurate points-to probability information

at every static pointer dereference

Scalable analysis Goal: The entire SPEC integer benchmark suite

Understand scalabilityscalability/accuracyaccuracy tradeoffthrough flexible static memory model

Improve our understanding of programs


Algorithm Design ChoicesAlgorithm Design ChoicesFixedFixed

Bottom Up / Top Down ApproachLinearLinear transfer functions (for scalability)

One-level contextcontext and flowflow sensitiveFlexibleFlexible

Edge profiling (or static prediction)

Safe (or unsafe)

Field sensitive (or field insensitive)


Traditional PointsTraditional Points--To GraphTo Graphint x, y, z, *b = &x;void foo(int *a) {

if(…) b = &y;

if(…)a = &z;

else(…) a = b;

while(…) {x = *a;…

}}

y UND

a

z

b

x

= pointer

= pointed at

Definitely

Maybe

=

=

Results are inconclusive


Probabilistic PointsProbabilistic Points--To GraphTo Graphint x, y, z, *b = &x;void foo(int *a) {

if(…) b = &y;

if(…)a = &z;

else(…) a = b;

while(…) {x = *a;…

}}

y UND

a

z

b

x

0.10.1 takentaken((edgeedge profileprofile))

0.20.2 takentaken((edgeedge profileprofile))

= pointer

= pointed at

p = 1.0

0.0<p< 1.0

=

=p

0.10.90.72

0.08

0.2

Results provide more information


LOLLOLLLIPIPOOPPOur PPA AlgorithmOur PPA Algorithm

LLinear inear OOne ne --LLevel evel IInterprocedural nterprocedural PProbabilistic robabilistic PPointer Analysisointer Analysis


PointsPoints--To MatrixTo Matrix

Location Sets

AreaOf

Interest

I

1

2

…

N-1

N

…

M-1 M

All matrix rows sum to 1.0

Location Sets

Pointer Sets


PointsPoints--To Matrix ExampleTo Matrix Example

y UNDzx

y

UND

z

x

a

b

0.72 0.08 0.20 0.90 0.10

1.0

1.0

1.0

1.0

Iy UND

a

z

b

x

0.10.90.72

0.08

0.2


Solving for a PointsSolving for a Points--To MatrixTo Matrix

IAny InstructionAny Instruction

I

Points-ToMatrix In

Points-ToMatrix Out


The Fundamental PPA EquationThe Fundamental PPA Equation

Points-ToMatrix Out

Points-ToMatrix In

TransformationMatrix=

This can be applied to any instruction (incl. function calls)


Transformation MatrixTransformation Matrix

1

2

N-1 N

ø I

1 2 3 …

…

N-1

N

…

Area of Interest

Location SetsPointer Sets

All matrix rows sum to 1.0

Location Sets

Pointer Sets


Transformation Matrix ExampleTransformation Matrix Example

y

UND

z

x

a

b

y UNDzxa b

1.0

1.0

1.0

1.0

1.0

1.0

S1:S1: a = &z;a = &z;

=TS1


1.0

1.0

1.0

1.0

1.0 1.0

Example Example -- The PPA EquationThe PPA EquationS1:S1: a = &z;a = &z;PTout = TS1 PTin

0.72 0.08 0.20 0.90 0.10

1.0

1.0

1.0

1.0

=PTout


Example Example -- The PPA EquationThe PPA Equation

y UNDzx

y

UND

z

x

a

b

1.0 0.90 0.10

1.0

1.0

1.0

1.0

y UNDz

b

x

0.10.9

a

S1:S1: a = &z;a = &z;PTout = TS1 PTin

=PTout


Combining Transformation MatricesCombining Transformation Matrices

IBasic Block

S1: S1: InstrInstr

S2: S2: InstrInstr

S3: S3: InstrInstr

I

PTout TS1=

PTin

TS3 PTin

PTout = TBB

TS1


Control flow Control flow -- if/elseif/else

YYXX

TX TY= +

p q

p q

p + q = 1.0


Control flow Control flow -- loopsloops

TX=XXN N

∑=

U

LiTY=

1U-L+1

i<L,U>

YY

Both operations can be implemented efficiently

<L,U> <min,max>


Safe vs. Unsafe Safe vs. Unsafe Pointer Assignment InstructionsPointer Assignment Instructions

Store Assignment*x = y

Load Assignmentx = *y

Copy Assignmentx = y

Address-of Assignmentx = &ySafe?


LOLLOLLLIPIPOOPP ImplementationImplementation

.spd

EdgeProfile

Results

SUIF Infrastructure

Static Memory

Model

MATLABC Library

TF-Matrix Collector

Points-ToMatrix

Propagator Stats

ICFGICFG SMMSMM BUBU TDTD .spx


MeasuringMeasuringLOLLOLLLIPIPOOPP’’s s

EfficiencyEfficiency and and AccuracyAccuracy


SPEC2000 Benchmark DataSPEC2000 Benchmark Data

Experimental Framework: 3GHz P4 with 2GB of RAM

PPA Analysis Time

[Safe]PPA Analysis Time

[Unsafe]Matrix Size N

LOCBenchmark

30.72 seconds273211402Parser

16.59 seconds261120469Twolf

9.33 seconds197617750Vpr

5.49 seconds191721297Crafty

0.71 seconds5638616Gzip

0.39 seconds3542429Mcf

0.3 seconds2514686Bzip2

50.04 seconds20.64 seconds10.34 seconds5.51 seconds0.77 seconds0.61 seconds0.3 seconds

5hour 10 min4210922225Gcc

44min 15seconds2092285221Perlbmk

54min 56seconds2588271766Gap

3min 59seconds1101867225Vortex

Still Running…89min 43seconds83min 38seconds4min 56seconds

Scales to all of SPECint


Comparison with Comparison with DasDas’’ss GOLFGOLF

YesNoProbabilistic

YesYesSafe

> 5 hours< 10 secondsAnalysis Time on GCC

ProfiledSolvedIndirect Calls

Modeled SomeModeled AllLibrary Calls

Callsite AllocCallsite AllocHeap Model

Turned OffNoField Sensitive

YesNoFlow Sensitive

One-levelOne-levelContext Sensitive

LOLLIPOPGOLF


Comparison with DasComparison with Das’’s GOLFs GOLFA

vera

ge D

eref

eren

ce S

ize

mor

e ac

cura

te

LOLLIPOP is very AccurateAccurate (even without probability information)

14.8

3.37.7

1.2

11.9

21.9

59.3

3.3 1.8 2.6 1.1

80.1

6.7

18.5

6.1

0

10

20

30

40

50

60

70

80

90

100

gom88

ksim *gcc

compres

s li

ijpeg perl

vorte

x

GOLFLOLLIPOP

185.6


Easy SPEC2000 BenchmarksEasy SPEC2000 Benchmarks

1.41.2

1.51.8

6.1

1.01.3

0

1

2

3

4

5

6

7

gzip vpr mcf crafty vortex bzip2 twolf

unsafesafep > 0.001

Ave

rage

Der

efer

ence

Siz

e

mor

e ac

cura

te

A one-level Analysis is often adequate (i.e. safe=unsafe)


Challenging SPEC 95/2000 BenchmarksChallenging SPEC 95/2000 Benchmarks

42.5

89.0

143.8

80.1

6.7

18.5

0

20

40

60

80

100

120

140

parser perlbmk gap li ijpeg perl

unsafesafep > 0.001

Ave

rage

Der

efer

ence

Siz

e

mor

e ac

cura

te

Many improbable points-to relations can be pruned away


Metric: Average Certainty Metric: Average Certainty

while(…){

x = *a; …

}

{ (0.72, ), (0.08, ), (0.2, ) }y zx

Σ(max probability value)

(num of loads & stores)Avg Certainty =

Max probability value = 0.72


SPEC2000 Average CertaintySPEC2000 Average Certainty

0.9050.949 0.970

0.920 0.946 0.969

0.870

0.783

0.9081.000

0.901

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

gzip vpr

*gcc mcf

crafty

parse

rpe

rlbmk

gap

vorte

xbz

ip2 twolf

Prob

abili

stic

Cer

tain

ty

mor

e ac

cura

te

On average, LOLLIPOP can predict a single likely points-to relation


Conclusions and Future WorkConclusions and Future Work

LOLLOLLLIPIPOOPPA novel PPA algorithmScales to SPECint 95/2000As accurate as the most precise algorithms

Future Ongoing WorkFuture Ongoing WorkMeasure the probabilistic accuracyOptimize LOLLIPOP’s implementationApply PPA

Provides the key puzzle piece for a speculation compiler


ReferencesReferencesManuvir Das, Ben Liblit, Manuel Fahndrich, and Jakob Rehof. Estimating the Impact of Scalable Pointer Analysis on Optimization. SAS 2001, 260-278.

Peng-Sheng Chen, Ming-Yu Hung, Yuan-Shin Hwang, Roy Dz-Ching Ju, and Jenq Kuen Lee. Compiler support for speculative multithreading architecture with probabilistic points-to analysis. PPOPP 2003, 25-36.

Jin Lin, Tong Chen, Wei-Chung Hsu, Peng-Chung Yew, Roy Dz-Ching Ju, Tin-Fook Ngai and Sun Chan, A Compiler Framework for Speculative Analysis and Optimizations. PLDI 2003, 289-299.

R.D. Ju, J. Collard, and K. Oukbir. Probabilistic Memory Disambiguation and its Application to Data Speculation. SIGARCH Comput. Archit. News 27 1999, 27-30.

Manel Fernandez and Roger Espasa. Speculative Alias Analysis for Executable Code. PACT 2002, 221-231.

a probabilistic pointer analysis for speculative...

Documents