1. Timing Analysis of Embedded Software for Speculative Processors Tulika Mitra Abhik Roychoudhury Xianfeng Li School of Computing National University of Singapore

2. 2ISSS'02 Why Timing Analysis? Timing guarantees for real time embedded sys Timing guarantees for real time embedded sys Real time scheduling: Worst case bound on execution time so that tasks are guaranteed to be schedulable irrespective of inputs Real time scheduling: Worst case bound on execution time so that tasks are guaranteed to be schedulable irrespective of inputs Tight bound to avoid idle processor cycles Tight bound to avoid idle processor cycles Extremely important for safety critical systems Extremely important for safety critical systems

3. 3ISSS'02 Worst Case Execution Time (WCET) Given a program and a micro-architecture, estimate the maximum execution time of the program on the micro-architecture for all possible inputs Given a program and a micro-architecture, estimate the maximum execution time of the program on the micro-architecture for all possible inputs Program path analysis [Shaw’89, Healy’98,..] Program path analysis [Shaw’89, Healy’98,..] All possible paths in control flow graph are not feasible All possible paths in control flow graph are not feasible Micro-architectural modeling Micro-architectural modeling Dynamically variable instruction execution time due to Dynamically variable instruction execution time due to Cache, Pipeline [Li’99, Theiling’00, Schneider’99,..] Cache, Pipeline [Li’99, Theiling’00, Schneider’99,..] Speculative execution (branch prediction) Speculative execution (branch prediction)

4. 4ISSS'02 Speculative Execution No Speculative Execution No Speculative Execution Misprediction Misprediction Correct prediction Correct prediction b NT S Misprediction penalty

5. 5ISSS'02 Impact of Speculative Execution Example: Insertion sort of 100 elements Example: Insertion sort of 100 elements Worst case path without speculation for input Worst case path without speculation for input Worst case path with speculation for input Worst case path with speculation for input Branch misprediction penalty can alter worst case execution path

6. 6ISSS'02 Branch Prediction Schemes SchemeFeature WCET Work Static Static assignment of prediction per branch Chen et. al. 2001 DynamicLocal Predict based on outcome history of this branch only Colin & Puat 2000 Global [PowerPC, MIPS, AMD, Alpha] Predict based on outcome history of neighboring branches 

7. 7ISSS'02 Global Branch Prediction outcome (B3) = 1 if outcome (B1 B2) = {01, 10, 11} Stores the outcomes of last n branches in a shift register, called Branch History Register (BHR) Index into the prediction table using BHR Prediction table stores the last outcome corresponding to that history b = 0 B1: if (a == 1) b = 1; B2: if (a == 2) b = 1; B3: if (b == 1) 0 1 1 1 0 1 BHR Prediction Table

8. 8ISSS'02 Framework for Branch Prediction Prediction Scheme Index Local Branch address Global: GAg BHR Global: gshare BHR  Branch address Global: gselect {Branch address, BHR} Prediction schemes differ in terms of the index into the prediction table

9. 9ISSS'02 Modeling Difficulty Dynamic mapping: A branch can map to different entries in the prediction table Dynamic mapping: A branch can map to different entries in the prediction table Aliasing: Different branches mapping to the same prediction table entry Aliasing: Different branches mapping to the same prediction table entry Constructive/destructive Conflict Constructive/destructive Conflict Conflicting branches with same/different outcomes Conflicting branches with same/different outcomes A single branch with same/different outcomes A single branch with same/different outcomes

10. 10ISSS'02 Our Technique: ILP Formulation Obtain linear constraints on total misprediction count for all possible inputs Obtain linear constraints on total misprediction count for all possible inputs Input: Control Flow Graph of the program Input: Control Flow Graph of the program Objective function: Objective function: WCET =  cost B  count B + penalty  misprediction B

11. 11ISSS'02 Flow Constraints: Easy !! c s = c e = 1 e s,1 = 1 e 2,e + e 1,e = 1 e s,1 + e 2,1 = e 1,2 + e 1,e = c 1 e 1,2 = e 2,e + e 2,1 = c 2 Loop bound: e 2,1 <= 100 start blk 1 blk 2 end U 0 1 0 1 Inflow = Basic Block Execution Count = Outflow Bound on maximum loop iterations

12. 12ISSS'02 Modeling Difficulty 1: Dynamic Mapping Identify possible patterns for each branch Identify possible patterns for each branch Static analysis of CFG for all possible patterns  in branch history register (BHR) at node i Static analysis of CFG for all possible patterns  in branch history register (BHR) at node i c i , e i, j  #exec. of node i, edge e i, j with BHR =  c i , e i, j  #exec. of node i, edge e i, j with BHR =  m i  #mispred. of node i with BHR =  m i  #mispred. of node i with BHR =  m i =  m i  c i =  c i  e i,j =  e i,j  e i,j =  e i,j  m i   c i  m i   c i 

13. 13ISSS'02 Modeling Difficulty 1: Dynamic Mapping Model flow of pattern among nodes and edges Model flow of pattern among nodes and edges start blk 1 blk 2 end U 0 1 0 1 inflow:c 1 01 = e 2,1 00 + e 2,1 10 inflow:c 1 01 = e 2,1 00 + e 2,1 10 outflow:c 1 01 = e 1,2 01 + e 1,e 01 outflow:c 1 01 = e 1,2 01 + e 1,e 01

14. 14ISSS'02 Modeling Difficulty 2: Aliasing Variable : Number of times Variable p  i  j : Number of times  occurs at node i followed by another occurrence at j  occurs at node i followed by another occurrence at j  does not appear in the intermediate nodes  does not appear in the intermediate nodes i j i j    

15. 15ISSS'02 Modeling Difficulty 2: Aliasing s e 3 6 8 p 3  6  p 8  3  p 3  8  p 6  8  p 6  e  p s  3  ∑ j p  j  i = ∑ j p  i  j = c i 

16. 16ISSS'02 Modeling Difficulty 3: Conflict Case 1: Branch of block i with  is taken Case 1: Branch of block i with  is taken Misprediction less than its total outflow under history  & outcome of branch i taken Misprediction less than its total outflow under history  & outcome of branch i taken  ∑ j ,1  ∑ j p ,1 i  j Misprediction less than its total inflow under history  & last outcome non-taken Misprediction less than its total inflow under history  & last outcome non-taken  ∑ j ,0  ∑ j p ,0 j  i Case 2: Branch of block i with  is Case 2: Branch of block i with  is non-taken non-taken i 10 0 1 ∑ j ,1 ∑ j p ,1 i  j ∑ j ,0 ∑ j p ,0 j  i

17. 17ISSS'02 Benchmarks ProgramDescription check Negative number search of 100-element array matsum Summation of two 100 x 100 matrices matmul Multiplication of two 10 x 10 matrices fft 1024-point Fast Fourier Transform fdct Fast Discrete Cosine Transform isort Insertion sort of 100-element array bsearch Binary search of 100-element array eqntott Drawn from SPEC’92 integer benchmarks dhry Dhrystone benchmark

18. 18ISSS'02 Modeling Accuracy Program WCETMisprediction Obs.Est.RatioObs.Est. check6116111.0033 matsum101,417101,4171.00204204 matmult14,73214,7321.00223223 fft213,052223,6401.053,1106,865 fdct2,4932,4931.0077 isort74,22574,7421.019,6879,954 bsearch1041041.0099 eqntott2,3112,3141.00203204 dhry122,026124,2971.022,2072,812

19. 19ISSS'02 Summary Modeling dynamic control speculation for timing analysis of embedded code Modeling dynamic control speculation for timing analysis of embedded code Unified parameterized framework that can be instantiated for various prediction schemes Unified parameterized framework that can be instantiated for various prediction schemes Tight execution time bound for benchmark programs under various prediction schemes and prediction table sizes Tight execution time bound for benchmark programs under various prediction schemes and prediction table sizes