a probabilistic pointer analysis for speculative...

A Probabilistic Pointer Analysis for Speculative Optimization

A Probabilistic Pointer Analysis for Speculative Optimization

Jeff DaSilva Greg SteffanJeff DaSilva Greg Steffan

Electrical and Computer EngineeringUniversity of TorontoToronto, ON, CanadaOct 17th, 2005

Electrical and Computer EngineeringUniversity of TorontoToronto, ON, CanadaOct 17th, 2005

2University Of Toronto

Pointers Impede OptimizationPointers Impede Optimization

Many optimizations come to a halt when they encounter an ambiguous pointer

foo(int *a) {…while(…){

x = *a; …

}}

Loop InvariantCode Motion

Parallelize

Pointer Analysis is Important

3University Of Toronto

Pointer AnalysisPointer Analysis

Do pointers a and b point to the same location?Do this for every pair of pointers at every program point

*a = ~~ = *b

*a = ~ ~ = *b

Definitely Not

Definitely

Maybe

PointerAnalysis

optimize

4University Of Toronto

Pointer analysisPointer analysis is a difficult problemscalablescalable and overly conservativeoverly conservative

failsfails--toto--scalescale and accurateaccurate

Ambiguous pointers will persisteven when using the most accurate accurate of algorithms

output is often unavoidable

What can be done with ?

Pointer Analysis is DifficultPointer Analysis is Difficult

Maybe

Maybe

oror

5University Of Toronto

Lets SpeculateLets Speculate

Compilers make conservativeconservative assumptionsThey must alwaysalways preserve program correctness

“It's easier to apologize than ask for permission.”Author: Anonymous

Implement a potentially unsafeunsafe optimizationVerifyVerify and RecoverRecover if necessary

6University Of Toronto

Speculation applied to PointersSpeculation applied to Pointers

int *a, x;…while(…){

x = *a; …

}

a is probably loop invariant

int *a, x, tmp;…tmp = *a;while(…){

x = tmp; …

} <verify, recover?><verify, recover?>

7University Of Toronto

Data Speculative OptimizationsData Speculative OptimizationsThe EPIC Instruction set

Explicit support for speculative load/store instructions (eg. Itanium)

Speculative compiler transformationsDead store elimination, redundancy elimination, copy propagation, strength reduction, register promotion

Thread-level speculation (TLS) Hardware support for tracking speculative parallel threads

Transactional programmingRollback support for aborted transactions

When to speculate? Techniques rely on profiling

8University Of Toronto

Quantitative Output RequiredQuantitative Output Required

Estimate the potential benefit for speculating:

SPECULATE?

ExpectedExpectedspeedupspeedup(if successful)(if successful)

RecoveryRecoverypenaltypenalty

(if unsuccessful)(if unsuccessful)OverheadOverheadfor verifyfor verify

Probabilistic output neededMaybe

Maybe

Maybe

ProbabilityProbabilityof successof success

9University Of Toronto

Conventional Pointer AnalysisConventional Pointer Analysis

Do pointers a and b point to the same location?Do this for every pair of pointers at every program point

*a = ~~ = *b

*a = ~ ~ = *b

Definitely Not

Definitely

Maybe

PointerAnalysis

optimizeoptimize

10University Of Toronto

*a = ~~ = *b

*a = ~ ~ = *b

optimize

Probabilistic Pointer Analysis Probabilistic Pointer Analysis (PPA)(PPA)

PPApp = 0.0pp = 1.0

0.0 < pp < 1.0

With what probability pp, do pointers a and b point to the same location?

Do this for every pair of pointers at every program point

optimize

11University Of Toronto

PPA Research ObjectivesPPA Research ObjectivesAccurate points-to probability information

at every static pointer dereference

Scalable analysis Goal: The entire SPEC integer benchmark suite

Understand scalabilityscalability/accuracyaccuracy tradeoffthrough flexible static memory model

Improve our understanding of programs

12University Of Toronto

Algorithm Design ChoicesAlgorithm Design ChoicesFixedFixed

Bottom Up / Top Down ApproachLinearLinear transfer functions (for scalability)

One-level contextcontext and flowflow sensitiveFlexibleFlexible

Edge profiling (or static prediction)

Safe (or unsafe)

Field sensitive (or field insensitive)

13University Of Toronto

Traditional PointsTraditional Points--To GraphTo Graphint x, y, z, *b = &x;void foo(int *a) {

if(…) b = &y;

if(…)a = &z;

else(…) a = b;

while(…) {x = *a;…

}}

y UND

a

z

b

x

= pointer

= pointed at

Definitely

Maybe

=

=

Results are inconclusive

14University Of Toronto

Probabilistic PointsProbabilistic Points--To GraphTo Graphint x, y, z, *b = &x;void foo(int *a) {

if(…) b = &y;

if(…)a = &z;

else(…) a = b;

while(…) {x = *a;…

}}

y UND

a

z

b

x

0.10.1 takentaken((edgeedge profileprofile))

0.20.2 takentaken((edgeedge profileprofile))

= pointer

= pointed at

p = 1.0

0.0<p< 1.0

=

=p

0.10.90.72

0.08

0.2

Results provide more information

15University Of Toronto

LOLLOLLLIPIPOOPPOur PPA AlgorithmOur PPA Algorithm

LLinear inear OOne ne --LLevel evel IInterprocedural nterprocedural PProbabilistic robabilistic PPointer Analysisointer Analysis

16University Of Toronto

PointsPoints--To MatrixTo Matrix

Location Sets

AreaOf

Interest

I

1

2

…

N-1

N

…

M-1 M

All matrix rows sum to 1.0

Location Sets

Pointer Sets

17University Of Toronto

PointsPoints--To Matrix ExampleTo Matrix Example

y UNDzx

y

UND

z

x

a

b

0.72 0.08 0.20 0.90 0.10

1.0

1.0

1.0

1.0

Iy UND

a

z

b

x

0.10.90.72

0.08

0.2

18University Of Toronto

Solving for a PointsSolving for a Points--To MatrixTo Matrix

IAny InstructionAny Instruction

I

Points-ToMatrix In

Points-ToMatrix Out

19University Of Toronto

The Fundamental PPA EquationThe Fundamental PPA Equation

Points-ToMatrix Out

Points-ToMatrix In

TransformationMatrix=

This can be applied to any instruction (incl. function calls)

20University Of Toronto

Transformation MatrixTransformation Matrix

1

2

N-1 N

ø I

1 2 3 …

…

N-1

N

…

Area of Interest

Location SetsPointer Sets

All matrix rows sum to 1.0

Location Sets

Pointer Sets

21University Of Toronto

Transformation Matrix ExampleTransformation Matrix Example

y

UND

z

x

a

b

y UNDzxa b

1.0

1.0

1.0

1.0

1.0

1.0

S1:S1: a = &z;a = &z;

=TS1

22University Of Toronto

1.0

1.0

1.0

1.0

1.0 1.0

Example Example -- The PPA EquationThe PPA EquationS1:S1: a = &z;a = &z;PTout = TS1 PTin

0.72 0.08 0.20 0.90 0.10

1.0

1.0

1.0

1.0

=PTout

23University Of Toronto

Example Example -- The PPA EquationThe PPA Equation

y UNDzx

y

UND

z

x

a

b

1.0 0.90 0.10

1.0

1.0

1.0

1.0

y UNDz

b

x

0.10.9

a

S1:S1: a = &z;a = &z;PTout = TS1 PTin

=PTout

24University Of Toronto

Combining Transformation MatricesCombining Transformation Matrices

IBasic Block

S1: S1: InstrInstr

S2: S2: InstrInstr

S3: S3: InstrInstr

I

PTout TS1=

PTin

TS3 PTin

PTout = TBB

TS1

25University Of Toronto

Control flow Control flow -- if/elseif/else

YYXX

TX TY= +

p q

p q

p + q = 1.0

26University Of Toronto

Control flow Control flow -- loopsloops

TX=XXN N

∑=

U

LiTY=

1U-L+1

i<L,U>

YY

Both operations can be implemented efficiently

<L,U> <min,max>

27University Of Toronto

Safe vs. Unsafe Safe vs. Unsafe Pointer Assignment InstructionsPointer Assignment Instructions

Store Assignment*x = y

Load Assignmentx = *y

Copy Assignmentx = y

Address-of Assignmentx = &ySafe?

28University Of Toronto

LOLLOLLLIPIPOOPP ImplementationImplementation

.spd

EdgeProfile

Results

SUIF Infrastructure

Static Memory

Model

MATLABC Library

TF-Matrix Collector

Points-ToMatrix

Propagator Stats

ICFGICFG SMMSMM BUBU TDTD .spx

29University Of Toronto

MeasuringMeasuringLOLLOLLLIPIPOOPP’’s s

EfficiencyEfficiency and and AccuracyAccuracy

30University Of Toronto

SPEC2000 Benchmark DataSPEC2000 Benchmark Data

Experimental Framework: 3GHz P4 with 2GB of RAM

PPA Analysis Time

[Safe]PPA Analysis Time

[Unsafe]Matrix Size N

LOCBenchmark

30.72 seconds273211402Parser

16.59 seconds261120469Twolf

9.33 seconds197617750Vpr

5.49 seconds191721297Crafty

0.71 seconds5638616Gzip

0.39 seconds3542429Mcf

0.3 seconds2514686Bzip2

50.04 seconds20.64 seconds10.34 seconds5.51 seconds0.77 seconds0.61 seconds0.3 seconds

5hour 10 min4210922225Gcc

44min 15seconds2092285221Perlbmk

54min 56seconds2588271766Gap

3min 59seconds1101867225Vortex

Still Running…89min 43seconds83min 38seconds4min 56seconds

Scales to all of SPECint

31University Of Toronto

Comparison with Comparison with DasDas’’ss GOLFGOLF

YesNoProbabilistic

YesYesSafe

> 5 hours< 10 secondsAnalysis Time on GCC

ProfiledSolvedIndirect Calls

Modeled SomeModeled AllLibrary Calls

Callsite AllocCallsite AllocHeap Model

Turned OffNoField Sensitive

YesNoFlow Sensitive

One-levelOne-levelContext Sensitive

LOLLIPOPGOLF

32University Of Toronto

Comparison with DasComparison with Das’’s GOLFs GOLFA

vera

ge D

eref

eren

ce S

ize

mor

e ac

cura

te

LOLLIPOP is very AccurateAccurate (even without probability information)

14.8

3.37.7

1.2

11.9

21.9

59.3

3.3 1.8 2.6 1.1

80.1

6.7

18.5

6.1

0

10

20

30

40

50

60

70

80

90

100

gom88

ksim *gcc

compres

s li

ijpeg perl

vorte

x

GOLFLOLLIPOP

185.6

33University Of Toronto

Easy SPEC2000 BenchmarksEasy SPEC2000 Benchmarks

1.41.2

1.51.8

6.1

1.01.3

0

1

2

3

4

5

6

7

gzip vpr mcf crafty vortex bzip2 twolf

unsafesafep > 0.001

Ave

rage

Der

efer

ence

Siz

e

mor

e ac

cura

te

A one-level Analysis is often adequate (i.e. safe=unsafe)

34University Of Toronto

Challenging SPEC 95/2000 BenchmarksChallenging SPEC 95/2000 Benchmarks

42.5

89.0

143.8

80.1

6.7

18.5

0

20

40

60

80

100

120

140

parser perlbmk gap li ijpeg perl

unsafesafep > 0.001

Ave

rage

Der

efer

ence

Siz

e

mor

e ac

cura

te

Many improbable points-to relations can be pruned away

35University Of Toronto

Metric: Average Certainty Metric: Average Certainty

while(…){

x = *a; …

}

{ (0.72, ), (0.08, ), (0.2, ) }y zx

Σ(max probability value)

(num of loads & stores)Avg Certainty =

Max probability value = 0.72

36University Of Toronto

SPEC2000 Average CertaintySPEC2000 Average Certainty

0.9050.949 0.970

0.920 0.946 0.969

0.870

0.783

0.9081.000

0.901

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

gzip vpr

*gcc mcf

crafty

parse

rpe

rlbmk

gap

vorte

xbz

ip2 twolf

Prob

abili

stic

Cer

tain

ty

mor

e ac

cura

te

On average, LOLLIPOP can predict a single likely points-to relation

37University Of Toronto

Conclusions and Future WorkConclusions and Future Work

LOLLOLLLIPIPOOPPA novel PPA algorithmScales to SPECint 95/2000As accurate as the most precise algorithms

Future Ongoing WorkFuture Ongoing WorkMeasure the probabilistic accuracyOptimize LOLLIPOP’s implementationApply PPA

Provides the key puzzle piece for a speculation compiler

38University Of Toronto

ReferencesReferencesManuvir Das, Ben Liblit, Manuel Fahndrich, and Jakob Rehof. Estimating the Impact of Scalable Pointer Analysis on Optimization. SAS 2001, 260-278.

Peng-Sheng Chen, Ming-Yu Hung, Yuan-Shin Hwang, Roy Dz-Ching Ju, and Jenq Kuen Lee. Compiler support for speculative multithreading architecture with probabilistic points-to analysis. PPOPP 2003, 25-36.

Jin Lin, Tong Chen, Wei-Chung Hsu, Peng-Chung Yew, Roy Dz-Ching Ju, Tin-Fook Ngai and Sun Chan, A Compiler Framework for Speculative Analysis and Optimizations. PLDI 2003, 289-299.

R.D. Ju, J. Collard, and K. Oukbir. Probabilistic Memory Disambiguation and its Application to Data Speculation. SIGARCH Comput. Archit. News 27 1999, 27-30.

Manel Fernandez and Roger Espasa. Speculative Alias Analysis for Executable Code. PACT 2002, 221-231.