1 / 68

Probabilistic Pointer Analysis [PPA]

Probabilistic Pointer Analysis [PPA]. Presented by: Jeff DaSilva. CARG April 12, 2005. Typically, ‘Maybe’ is treated like ‘Definitely’. Definitely. Definitely Not. Maybe. *A = ~. ~ = *B. The Pointer Alias Analysis Problem.

brittney-foley
Download Presentation

Probabilistic Pointer Analysis [PPA]

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Probabilistic Pointer Analysis [PPA] Presented by: Jeff DaSilva CARG April 12, 2005

  2. Typically, ‘Maybe’ is treated like ‘Definitely’ Definitely Definitely Not Maybe *A = ~ ~ = *B The Pointer Alias Analysis Problem • Statically decide for any pair of pointers, at any point in the program, whether two pointers point to the same memory location. *A = ~ ~ = *B This problem is known to be undecidable. [Landi 1992]

  3. The Compiler Writer vs. The Programming Language Designer • Pointers are needed by programmers to realize complex data structures • Pointers can make life difficult for optimizing compilers

  4. Concluding Remarks (from last time) • Traditional pointer analysis techniques are either overly conservative or are so complex that they fail to scale with respect to code size • Examples include: Address taken, Anderson’s analysis, Steensgaard,Emami • Pointer analysis is a very difficult problem that may never be adequately solved. • Does hardware support for data speculation make the analysis easier for the compiler?

  5. Support for Data Speculation Exists • EPIC instructionsets • Uses explicit load/store speculation • Thread Level Speculation (TLS) • Speculative Compiler Optimizations • Speculative PRE, register promotion and strength reduction [ ] • ‘Speculative’ behavioral synthesis Why are these techniques not more widely used? One Reason: Currently, they rely on data dependence profiling.

  6. void foo(int *a, int *b) { for(i = 0; i < N; i++) { x = *a + 1; *b = x; } } void foo_1(int *a, int *b) { x = *a + 1; *b = x; chk a != b } void foo_2(int *a, int *b) { x = *a + N; *b = x; chk a == b } Speculate a != b Speculate a == b ExampleSpeculative Compiler Optimization

  7. int *vector_add(int *a, int *b) { for(i = 0; i < N; i++) { a[i] = a[i] + b[i]; } return a; } ExampleThread Level Speculation (TLS)  Can this loop be parallelized? To take advantage of data speculation support, a probability metric and a cost function are required.

  8. Typically, ‘Maybe’ is treated like ‘Definitely’ Definitely Probability = 1.0 Definitely Not Probability = 0.0 Maybe 0.0 < p < 1.0 *A = ~ ~ = *B Probabilistic Pointer Analysis (PPA) • Statically decide for any pair of pointers, at any point in the program, whether two pointers point to the same memory location. *A = ~ ~ = *B • Statically estimate for any pair of pointers, at any point in the program, the probability that two pointers point to the same memory location. Isn’t this problem even worse? This problem is known to be undecidable. [Landi 1992]

  9. Outline • PPA Objectives • Probabilistic Pointer Analysis (PPA) Theory • The Probabilistic Points-To Graph • The Points-To Matrix • The Transformation Matrix • An Example • Some Preliminary Results

  10. Optimizing Compiler Dependence Analysis How is Pointer Analysis used? Pointer Analysis Executable Source Code

  11. x y z r s t a b c Traditional Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z;

  12. x y z r s t a b c Traditional Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

  13. x y z r s t a b c Traditional Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { x=&s; s=&c; }

  14. x y z r s t a b c Traditional Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { x=&s; s=&c; } r=&b;z=&r;

  15. x y z r s t a b c Traditional Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { x=&s; s=&c; } r=&b; z=&r; if(…) y = x;

  16. x y z r s t a b c Traditional Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { x=&s; s=&c; } r=&b; z=&r; if(…) y = x; *x = &a;

  17. Optimizing Compiler Probabilistic Dependence Analysis How is PPA used? Control Flow Edge Profiling (Optional) Probabilistic Pointer Analysis Speculative Executable Source Code with Data Speculation Support

  18. Definition: Probability Analysis • Let <p,v> denote a points-to relationship from a pointer p to a location v. • At every static program point s there exists a probability function P(s, <p,v>) that denotes the probability that p points to v during dynamic program execution. P(s, <p,v>) = D(s, <p,v>) / D(s) • Where D(s) is the number of times s is (expected to be) dynamically visited and D(s, <p,v>) is the number of times that the points-to relation <p,v> dynamically holds.

  19. Algorithm should output a Safe Conservative may alias Probability • A probability of 0.0 [P(s,<p,v>) = 0.0] indicates that a points-to relation <p,v> will never hold. • The converse in not necessarily true • A probability of 1.0 [P(s,<p,v>) = 1.0] indicates that a points to relation <p,v> will always hold. • The converse is also not necessarily true: a dynamic points-to relationship <p,v> that always exists may not be reported with a probability of 1.0

  20. x y z r s t a b c Probabilistic Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; 1.0 1.0 1.0 1.0 1.0 1.0

  21. x y z r s t a b c Probabilistic Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { /*60% taken*/ x=&s; s=&c; } 0.4 0.6 0.6 0.4

  22. x y z r s t a b c Probabilistic Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { /*60% taken*/ x=&s; s=&c; } r=&b;z=&r; 0.6 0.4 0.6 0.4

  23. y z x r s t a b c Probabilistic Points-To Graph int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { /*60% taken*/ x=&s; s=&c; } r=&b; z=&r; if(…) /*10% taken*/ y = x; 0.04 0.96 0.6 0.4 0.6 0.4

  24. Probabilistic Points-To Graph y int a, b, c; int *r, *s, *t; int **x, **y, **z; x=&r; y=&s; z=&t; r=&a; s=&b; z=&c; if(…) { /*60% taken*/ x=&s; s=&c; } r=&b; z=&r; if(…) /*10% taken*/ y = x; *x = &a; x z 0.04 0.6 0.96 0.4 r s t 0.4 0.16 0.4 0.24 0.6 0.6 0.6 a b c What is the probability that **y points to a?

  25. Our PPA Algorithm Objectives • An Interprocedural, Flow Sensitive, Context Sensitiveapproach that uses Linear Transfer Functions. • Must be scalable in time and space. • Provides an approximate probability for the ‘Maybe’ output.

  26. PPA • Polynomial Time Complexity • Inaccurate – many false ‘maybe’ outputs, but provides probability metric Accuracy/Efficiency Tradeoff • Doubly Exponential • Accurate – very few ‘maybe’ outputs • Does not scale BDD based Chen, et al: Only Other PPA Address-taken Anderson Steensgaard SPAN Emami • Linear Time Complexity • Inaccurate - many false ‘maybe’ outputs • Memory Required: Negligible

  27. Encoding the Probabilistic Points-To GraphThe Points-To Matrix • The Probabilistic Points-To graph is encoded using a sparse Markov Matrix • All elements are real numbers in the closed interval [0,1] • All rows sum to 1.0 • Each pointer set and location set is given a unique id representing it’s matrix row & column • Rules for linearity: • Pointers can only point to Location sets • Location sets always point to themselves with probability 1.0

  28. Points-To Matrix Structure Pointer Sets Location Sets 1 2 3 … N-1 N 1 2 ø Area Of Interest … Pointer Sets ø I … N-1 N Location Sets

  29. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } void foo() { for(i = 0; i < 10; i++) { if(…) q = &a; else p = q; } } int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } void foo() { for(i = 0; i < 10; i++) { if(…) /* 50% chance taken */ q = &a; else p = q; } } p q a b und p p q q a a b b und und p p 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.01.0 0.0 0.0 0.0 0.01.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 q q a a b b und und Points-To Matrix Example

  30. p q 0.04 0.46 0.5 a b und p q a b und p 0.0 0.01.0 0.0 0.0 0.0 0.00.5 0.46 0.04 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 q a b und Another Points-To Matrix Example

  31. p *p q q a b und 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.5 0.46 0.04 0.0 0.0 0.0 0.0 0.5 0.46 0.04 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 p p *p q q q 0.04 0.46 0.5 a a b und b und What about double pointers?

  32. Basic Pointer Assignments

  33. Transforming the points-to matrix • Let Xs represent the probabilistic points-to matrix at a specific program point s. XIN Basic pointer assignment instruction XOUT • Claim: There exists a transformation function T(X) for every instruction i, such that XOUT = Ti(XIN).

  34. The fundamental PPA Equation Points-To Matrix Out Transformation Matrix Points-To Matrix In =

  35. Transformation Matrix Structure Pointer Sets Location Sets 1 2 3 … N-1 N 1 2 Area of Interest … Pointer Sets ø I Location Sets … N-1 N

  36. int a, b, *p, *q; void main() { p = &a; q = &b; foo() } void foo() { for(i = 0; i < 10; i++) { if(…) q = &a; else p = q; } } p q a b und p 0.0 0.0 0.0 0.01.0 0.0 0.0 0.0 0.01.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 q a b und Example

  37. int a, b, *p, *q; void main() { p = &a; q = &b; foo() } Example 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.01.0 0.0 0.0 0.0 0.01.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0

  38. int a, b, *p, *q; void main() { p = &a; q = &b; foo() } p q a b und p 0.0 0.0 1.0 0.01.0 0.0 0.0 0.0 0.01.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 q p q a b a b und und Example 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.01.0 0.0 0.0 0.0 0.01.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 =

  39. Combining Transformation Matrices XOUT = T2 T1 XIN XIN T1: Basic pointer assignment instruction T2: Basic pointer assignment instruction XOUT

  40. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } Combining Transformation Matrices Example 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0

  41. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } Combining Transformation Matrices Example 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0

  42. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } Combining Transformation Matrices Example 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.001 0.01 0.9890.0 0.0 0.0 0.001 0.999 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0

  43. Combining Transformation Matrices Example 0.001 0.01 0.9890.0 0.0 0.0 0.001 0.999 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.99 0.01 0.0 0.0 0.0 0.999 0.001 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 =

  44. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } Combining Transformation Matrices Example 0.0 0.0 0.99 0.01 0.0 0.0 0.0 0.999 0.001 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0

  45. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } p q a b und p 0.0 0.0 .99 0.01 0.0 0.0 0.0 .999 0.001 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 q q p 0.999 0.01 a 0.99 0.001 b a b und und Combining Transformation Matrices Example 0.0 0.0 0.99 0.01 0.0 0.0 0.0 0.999 0.001 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.01.0 0.0 0.0 0.0 0.01.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 =

  46. int a, b, *p, *q; void main() { p = &a; q = &b; foo(); } void foo() { for(i = 0; i < 10; i++) { if(…) q = &a; else p = q; } } q = &a; p = q; < 9 > 0.001 0.01 0.9890.0 0.0 0.0 0.001 0.999 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 1.0 0.5 0.5 How to handle Control Flow? 1 3 2 4 [ ]^10 TF_foo = [0.5 +0.5 ] 3 2 1 4

  47. PPA Infrastructure Suif Infrastructure .spd files .spx files PPA Results ICFG Points-To Matrix Propagator [TD] Edge Profile Abstract Memory Model (AMM) Transformation Matrix Collector [BU] Transfer Function Builder (Suif2TF) PPA Matrix Builder MATLAB C Library MATLAB Debugging Script

  48. Current Results

  49. Current Results

  50. The End… • Any Comments or Questions?

More Related