David L. Heine

In search of speculative thread-level parallelism

The paper focuses in the problem of how to find and effectively exploit speculative thread-level parallelism. Our studies show that speculating only on loops does not yield sufficient parallelism. We propose the use of speculative procedure execution as a means to increase the available parallelism. An additional technique, data value prediction, has the potential to greatly improve the performance of speculative execution. In particular, return value prediction improves the success of procedural speculation, and stride value prediction improves the success of loop speculation.

A practical flow-sensitive and context-sensitive C and C++ memory leak detector

This paper presents a static analysis tool that can automatically find memory leaks and deletions of dangling pointers in large C and C++ applications.We have developed a type system to formalize a practical ownership model of memory management. In this model, every object is pointed to by one and only one owning pointer, which holds the exclusive right and obligation to either delete the object or to transfer the right to another owning pointer. In addition, a pointer-typed class member field is required to either always or never own its pointee at public method boundaries. Programs satisfying this model do not leak memory or delete the same object more than once.We have also developed a flow-sensitive and context-sensitive algorithm to automatically infer the likely ownership interfaces of methods in a program. It identifies statements inconsistent with the model as sources of potential leaks or double deletes. The algorithm is sound with respect to a large subset of the C and C++ language in that it will report all possible errors. It is also practical and useful as it identifies those warnings likely to correspond to errors and helps the user understand the reported errors by showing them the assumed method interfaces.Our techniques are validated with an implementation of a tool we call Clouseau. We applied Clouseau to a suite of applications: two web servers, a chat client, secure shell tools, executable object manipulation tools, and a compiler. The tool found a total of 134 serious memory errors in these applications. The tool analyzes over 50K lines of C++ code in about 9 minutes on a 2 GHz Pentium 4 machine and over 70K lines of C code in just over a minute.

Static detection of leaks in polymorphic containers

This paper presents the first practical static analysis tool that can find memory leaks and double deletions of objects held in polymorphic containers. This is especially important since most dynamically allocated objects are stored in containers.The tool is based on the concept of object ownership: every object has one and only one owning pointer. The owning pointer holds the exclusive right and obligation to either delete the object or to transfer the obligation. This paper presents a new type system that allows different instances of a polymorphic container to hold different types of elements, and to independently own or not own their elements.Our tool is sound: it will report all potential memory leaks and multiple deletions of pointers in a program. Our system automatically identifies the container implementation routines in an application. The user provides a short specification on the container structure and ownership constraints for these routines. The system then solves for the ownership constraints flow- and context-sensitively, and reports inconsistencies in ownership constraints as potential memory leaks and double deletions.We applied our tool to a suite of five large open-source and commercial C and C++ applications totaling one million lines of code. The tool successfully identified memory leaks in these programs and found double deletions of objects that could lead to program failures or security vulnerabilities.

Configurable, Extensible Processor System Simulation

This chapter discusses the challenges of creating an instruction set simulator (ISS) and system modeling environment for configurable, extensible processors. Processor generation technology is highly automated and is used by designers to create application-specific instruction set processors (ASIPs) targeted to specific application domains. The main challenges for creating an ISS lie in the configurable and extensible nature of the processor, which is tailored by designers at design time, not fixed in advance. Thus simulation models need to be created on the fly when designers have configured a new version of the processor. They need to be created automatically and offer good performance with a variety of use modes. In addition, multiple speed-accuracy trade-offs are necessary to support these various use modes, such as instruction-accurate, cycle-accurate, and pin-level. Furthermore, these ISS models must themselves fit into system modeling and simulation environments, both generated along with the ASIP and commercial third party ESL/EDA tools. Again, multiple use models and trade-offs in simulation scope, speed, and accuracy must be supported. Standards to ease integration and model interoperability in this area have arrived only recently and are just beginning to make life easier for model providers.

Configurability in IP subystems: baseband examples

Configurability in IP subsystems has two major motivations. The first is the requirements of the IP subsystem itself; the second the particular customer requirements, as every customer has unique things they want to change in a subsystem. Configurability manifests itself at two levels - the individual components, such as processors (ideally configurable), memories, and hardware blocks for specialized processing; the second one at the subsystem level, where component choices, interconnect and interfaces may all vary considerably. This paper discusses these concepts applied to practical, real, baseband subsystems for wireless communications. Configurability allows both scalability of a reference IP subsystem - e.g. to handle varieties of standards and use cases; and differentiation, so that customers get the optimal IP subsystem for their unique needs. This is illustrated with existing product-ready systems and cores, and future subsystem concepts that will allow even better scalability, performance, and adaptability for the next generation.