a probabilistic pointer analysis for speculative...
TRANSCRIPT
A Probabilistic Pointer Analysis for Speculative Optimization
A Probabilistic Pointer Analysis for Speculative Optimization
Jeff DaSilva Greg SteffanJeff DaSilva Greg Steffan
Electrical and Computer EngineeringUniversity of TorontoToronto, ON, CanadaOct 17th, 2005
Electrical and Computer EngineeringUniversity of TorontoToronto, ON, CanadaOct 17th, 2005
2University Of Toronto
Pointers Impede OptimizationPointers Impede Optimization
Many optimizations come to a halt when they encounter an ambiguous pointer
foo(int *a) {…while(…){
x = *a; …
}}
Loop InvariantCode Motion
Parallelize
Pointer Analysis is Important
3University Of Toronto
Pointer AnalysisPointer Analysis
Do pointers a and b point to the same location?Do this for every pair of pointers at every program point
*a = ~~ = *b
*a = ~ ~ = *b
Definitely Not
Definitely
Maybe
PointerAnalysis
optimize
4University Of Toronto
Pointer analysisPointer analysis is a difficult problemscalablescalable and overly conservativeoverly conservative
failsfails--toto--scalescale and accurateaccurate
Ambiguous pointers will persisteven when using the most accurate accurate of algorithms
output is often unavoidable
What can be done with ?
Pointer Analysis is DifficultPointer Analysis is Difficult
Maybe
Maybe
oror
5University Of Toronto
Lets SpeculateLets Speculate
Compilers make conservativeconservative assumptionsThey must alwaysalways preserve program correctness
“It's easier to apologize than ask for permission.”Author: Anonymous
Implement a potentially unsafeunsafe optimizationVerifyVerify and RecoverRecover if necessary
6University Of Toronto
Speculation applied to PointersSpeculation applied to Pointers
int *a, x;…while(…){
x = *a; …
}
a is probably loop invariant
int *a, x, tmp;…tmp = *a;while(…){
x = tmp; …
} <verify, recover?><verify, recover?>
7University Of Toronto
Data Speculative OptimizationsData Speculative OptimizationsThe EPIC Instruction set
Explicit support for speculative load/store instructions (eg. Itanium)
Speculative compiler transformationsDead store elimination, redundancy elimination, copy propagation, strength reduction, register promotion
Thread-level speculation (TLS) Hardware support for tracking speculative parallel threads
Transactional programmingRollback support for aborted transactions
When to speculate? Techniques rely on profiling
8University Of Toronto
Quantitative Output RequiredQuantitative Output Required
Estimate the potential benefit for speculating:
SPECULATE?
ExpectedExpectedspeedupspeedup(if successful)(if successful)
RecoveryRecoverypenaltypenalty
(if unsuccessful)(if unsuccessful)OverheadOverheadfor verifyfor verify
Probabilistic output neededMaybe
Maybe
Maybe
ProbabilityProbabilityof successof success
9University Of Toronto
Conventional Pointer AnalysisConventional Pointer Analysis
Do pointers a and b point to the same location?Do this for every pair of pointers at every program point
*a = ~~ = *b
*a = ~ ~ = *b
Definitely Not
Definitely
Maybe
PointerAnalysis
optimizeoptimize
10University Of Toronto
*a = ~~ = *b
*a = ~ ~ = *b
optimize
Probabilistic Pointer Analysis Probabilistic Pointer Analysis (PPA)(PPA)
PPApp = 0.0pp = 1.0
0.0 < pp < 1.0
With what probability pp, do pointers a and b point to the same location?
Do this for every pair of pointers at every program point
optimize
11University Of Toronto
PPA Research ObjectivesPPA Research ObjectivesAccurate points-to probability information
at every static pointer dereference
Scalable analysis Goal: The entire SPEC integer benchmark suite
Understand scalabilityscalability/accuracyaccuracy tradeoffthrough flexible static memory model
Improve our understanding of programs
12University Of Toronto
Algorithm Design ChoicesAlgorithm Design ChoicesFixedFixed
Bottom Up / Top Down ApproachLinearLinear transfer functions (for scalability)
One-level contextcontext and flowflow sensitiveFlexibleFlexible
Edge profiling (or static prediction)
Safe (or unsafe)
Field sensitive (or field insensitive)
13University Of Toronto
Traditional PointsTraditional Points--To GraphTo Graphint x, y, z, *b = &x;void foo(int *a) {
if(…) b = &y;
if(…)a = &z;
else(…) a = b;
while(…) {x = *a;…
}}
y UND
a
z
b
x
= pointer
= pointed at
Definitely
Maybe
=
=
Results are inconclusive
14University Of Toronto
Probabilistic PointsProbabilistic Points--To GraphTo Graphint x, y, z, *b = &x;void foo(int *a) {
if(…) b = &y;
if(…)a = &z;
else(…) a = b;
while(…) {x = *a;…
}}
y UND
a
z
b
x
0.10.1 takentaken((edgeedge profileprofile))
0.20.2 takentaken((edgeedge profileprofile))
= pointer
= pointed at
p = 1.0
0.0<p< 1.0
=
=p
0.10.90.72
0.08
0.2
Results provide more information
15University Of Toronto
LOLLOLLLIPIPOOPPOur PPA AlgorithmOur PPA Algorithm
LLinear inear OOne ne --LLevel evel IInterprocedural nterprocedural PProbabilistic robabilistic PPointer Analysisointer Analysis
16University Of Toronto
PointsPoints--To MatrixTo Matrix
Location Sets
AreaOf
Interest
I
1
2
…
N-1
N
…
M-1 M
All matrix rows sum to 1.0
Location Sets
Pointer Sets
17University Of Toronto
PointsPoints--To Matrix ExampleTo Matrix Example
y UNDzx
y
UND
z
x
a
b
0.72 0.08 0.20 0.90 0.10
1.0
1.0
1.0
1.0
Iy UND
a
z
b
x
0.10.90.72
0.08
0.2
18University Of Toronto
Solving for a PointsSolving for a Points--To MatrixTo Matrix
IAny InstructionAny Instruction
I
Points-ToMatrix In
Points-ToMatrix Out
19University Of Toronto
The Fundamental PPA EquationThe Fundamental PPA Equation
Points-ToMatrix Out
Points-ToMatrix In
TransformationMatrix=
This can be applied to any instruction (incl. function calls)
20University Of Toronto
Transformation MatrixTransformation Matrix
1
2
N-1 N
ø I
1 2 3 …
…
N-1
N
…
Area of Interest
Location SetsPointer Sets
All matrix rows sum to 1.0
Location Sets
Pointer Sets
21University Of Toronto
Transformation Matrix ExampleTransformation Matrix Example
y
UND
z
x
a
b
y UNDzxa b
1.0
1.0
1.0
1.0
1.0
1.0
S1:S1: a = &z;a = &z;
=TS1
22University Of Toronto
1.0
1.0
1.0
1.0
1.0 1.0
Example Example -- The PPA EquationThe PPA EquationS1:S1: a = &z;a = &z;PTout = TS1 PTin
0.72 0.08 0.20 0.90 0.10
1.0
1.0
1.0
1.0
=PTout
23University Of Toronto
Example Example -- The PPA EquationThe PPA Equation
y UNDzx
y
UND
z
x
a
b
1.0 0.90 0.10
1.0
1.0
1.0
1.0
y UNDz
b
x
0.10.9
a
S1:S1: a = &z;a = &z;PTout = TS1 PTin
=PTout
24University Of Toronto
Combining Transformation MatricesCombining Transformation Matrices
IBasic Block
S1: S1: InstrInstr
S2: S2: InstrInstr
S3: S3: InstrInstr
I
PTout TS1=
PTin
TS3 PTin
PTout = TBB
TS1
25University Of Toronto
Control flow Control flow -- if/elseif/else
YYXX
TX TY= +
p q
p q
p + q = 1.0
26University Of Toronto
Control flow Control flow -- loopsloops
TX=XXN N
∑=
U
LiTY=
1U-L+1
i<L,U>
YY
Both operations can be implemented efficiently
<L,U> <min,max>
27University Of Toronto
Safe vs. Unsafe Safe vs. Unsafe Pointer Assignment InstructionsPointer Assignment Instructions
Store Assignment*x = y
Load Assignmentx = *y
Copy Assignmentx = y
Address-of Assignmentx = &ySafe?
28University Of Toronto
LOLLOLLLIPIPOOPP ImplementationImplementation
.spd
EdgeProfile
Results
SUIF Infrastructure
Static Memory
Model
MATLABC Library
TF-Matrix Collector
Points-ToMatrix
Propagator Stats
ICFGICFG SMMSMM BUBU TDTD .spx
29University Of Toronto
MeasuringMeasuringLOLLOLLLIPIPOOPP’’s s
EfficiencyEfficiency and and AccuracyAccuracy
30University Of Toronto
SPEC2000 Benchmark DataSPEC2000 Benchmark Data
Experimental Framework: 3GHz P4 with 2GB of RAM
PPA Analysis Time
[Safe]PPA Analysis Time
[Unsafe]Matrix Size N
LOCBenchmark
30.72 seconds273211402Parser
16.59 seconds261120469Twolf
9.33 seconds197617750Vpr
5.49 seconds191721297Crafty
0.71 seconds5638616Gzip
0.39 seconds3542429Mcf
0.3 seconds2514686Bzip2
50.04 seconds20.64 seconds10.34 seconds5.51 seconds0.77 seconds0.61 seconds0.3 seconds
5hour 10 min4210922225Gcc
44min 15seconds2092285221Perlbmk
54min 56seconds2588271766Gap
3min 59seconds1101867225Vortex
Still Running…89min 43seconds83min 38seconds4min 56seconds
Scales to all of SPECint
31University Of Toronto
Comparison with Comparison with DasDas’’ss GOLFGOLF
YesNoProbabilistic
YesYesSafe
> 5 hours< 10 secondsAnalysis Time on GCC
ProfiledSolvedIndirect Calls
Modeled SomeModeled AllLibrary Calls
Callsite AllocCallsite AllocHeap Model
Turned OffNoField Sensitive
YesNoFlow Sensitive
One-levelOne-levelContext Sensitive
LOLLIPOPGOLF
32University Of Toronto
Comparison with DasComparison with Das’’s GOLFs GOLFA
vera
ge D
eref
eren
ce S
ize
mor
e ac
cura
te
LOLLIPOP is very AccurateAccurate (even without probability information)
14.8
3.37.7
1.2
11.9
21.9
59.3
3.3 1.8 2.6 1.1
80.1
6.7
18.5
6.1
0
10
20
30
40
50
60
70
80
90
100
gom88
ksim *gcc
compres
s li
ijpeg perl
vorte
x
GOLFLOLLIPOP
185.6
33University Of Toronto
Easy SPEC2000 BenchmarksEasy SPEC2000 Benchmarks
1.41.2
1.51.8
6.1
1.01.3
0
1
2
3
4
5
6
7
gzip vpr mcf crafty vortex bzip2 twolf
unsafesafep > 0.001
Ave
rage
Der
efer
ence
Siz
e
mor
e ac
cura
te
A one-level Analysis is often adequate (i.e. safe=unsafe)
34University Of Toronto
Challenging SPEC 95/2000 BenchmarksChallenging SPEC 95/2000 Benchmarks
42.5
89.0
143.8
80.1
6.7
18.5
0
20
40
60
80
100
120
140
parser perlbmk gap li ijpeg perl
unsafesafep > 0.001
Ave
rage
Der
efer
ence
Siz
e
mor
e ac
cura
te
Many improbable points-to relations can be pruned away
35University Of Toronto
Metric: Average Certainty Metric: Average Certainty
while(…){
x = *a; …
}
{ (0.72, ), (0.08, ), (0.2, ) }y zx
Σ(max probability value)
(num of loads & stores)Avg Certainty =
Max probability value = 0.72
36University Of Toronto
SPEC2000 Average CertaintySPEC2000 Average Certainty
0.9050.949 0.970
0.920 0.946 0.969
0.870
0.783
0.9081.000
0.901
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
gzip vpr
*gcc mcf
crafty
parse
rpe
rlbmk
gap
vorte
xbz
ip2 twolf
Prob
abili
stic
Cer
tain
ty
mor
e ac
cura
te
On average, LOLLIPOP can predict a single likely points-to relation
37University Of Toronto
Conclusions and Future WorkConclusions and Future Work
LOLLOLLLIPIPOOPPA novel PPA algorithmScales to SPECint 95/2000As accurate as the most precise algorithms
Future Ongoing WorkFuture Ongoing WorkMeasure the probabilistic accuracyOptimize LOLLIPOP’s implementationApply PPA
Provides the key puzzle piece for a speculation compiler
38University Of Toronto
ReferencesReferencesManuvir Das, Ben Liblit, Manuel Fahndrich, and Jakob Rehof. Estimating the Impact of Scalable Pointer Analysis on Optimization. SAS 2001, 260-278.
Peng-Sheng Chen, Ming-Yu Hung, Yuan-Shin Hwang, Roy Dz-Ching Ju, and Jenq Kuen Lee. Compiler support for speculative multithreading architecture with probabilistic points-to analysis. PPOPP 2003, 25-36.
Jin Lin, Tong Chen, Wei-Chung Hsu, Peng-Chung Yew, Roy Dz-Ching Ju, Tin-Fook Ngai and Sun Chan, A Compiler Framework for Speculative Analysis and Optimizations. PLDI 2003, 289-299.
R.D. Ju, J. Collard, and K. Oukbir. Probabilistic Memory Disambiguation and its Application to Data Speculation. SIGARCH Comput. Archit. News 27 1999, 27-30.
Manel Fernandez and Roger Espasa. Speculative Alias Analysis for Executable Code. PACT 2002, 221-231.