Synthesizing Loops For Program Inversion Cong Hou, Daniel Quinlan, - PowerPoint PPT Presentation

For RC 2012 Synthesizing Loops For Program Inversion Cong Hou, Daniel Quinlan, David Jefferson, Richard Fujimoto, Richard Vuduc

Program Inversion • Given a program P , and its inverse P - , then we have P ; P - = no-op • Examples: ++a / --a , swap(a,b) / swap(a,b) , compression/ decompression, encryption/decryption, etc.. • Assume the input and output of P are IN and OUT : P IN OUT P- Reverse program 2

Program Inversion • What if P is not reversible? IN : a a = 0; OUT : a P 3

Program Inversion • What if P is not reversible? IN : a a = 0; OUT : a P • Make it reversible! IN : a IN : a, s s = a; a = s; a = 0; OUT : a OUT : a, s P + P - 3

Program Inversion • What if P is not reversible? IN : a a = 0; OUT : a P • Make it reversible! State Saving IN : a IN : a, s s = a; a = s; a = 0; OUT : a OUT : a, s P + P - 3

Program Inversion • What if P is not reversible? IN : a a = 0; OUT : a P • Make it reversible! State Saving Forward program IN : a P + IN : a, s s = a; IN OUT+S a = s; a = 0; P- OUT : a OUT : a, s Reverse program P + P - 3

Our Previous Work • We have built a framework that can generate the forward and reverse programs for loop-free programs. • We have implemented this framework into a compiler called Backstroke. • For more details please refer to our CC paper: C. Hou, G. Vulov, D. Quinlan, D. Jefferson, R. Fujimoto, and R. Vuduc. A new method for program inversion. International Conference on Compiler Construction, 2012. 4

Overview Of Our Previous Work • Our approach: Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions 5

Overview Of Our Previous Work Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions • We turn the program into the SSA (Static Single Assignment) form CFG (Control Flow Graph) , so that each variable is defined only once and can represent a distinct value. An SSA graph is then built to show the data dependencies between different values. 6

Overview Of Our Previous Work Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions • We build a Value Search Graph (VSG) showing all equality relations between values in the program. Finding the inverse becomes a search problem in this graph. Each equality is constrained by a condition represented by a set of CFG paths. 7

Overview Of Our Previous Work Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions • We then search for the desired values by following the equalities until available values are reached. The search should guarantee that each value is retrieved for all CFG paths. The search result which we call a Route Graph (RG) shows valid data dependences in reverse program. 8

Overview Of Our Previous Work Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions • The forward and reverse programs are built based on the search result. 9

Example: Building SSA Form CFG Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions IN : a, b Entry void foo() if (a0 == 0) { if (a == 0) T F a = 1; b1 = a0 + 10; a1 = 1; else a2 = 0; { b = a + 10; a3 = Φ (a1, a2); a = 0; b2 = Φ (b0, b1); } } Exit OUT : a, b SSA form CFG 10

Example: Building SSA Graph Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions Entry Φ if (a0 == 0) a 3 T F 1 0 b1 = a0 + 10; Φ a1 = 1; a 1 a 2 a2 = 0; b 2 + == a3 = Φ (a1, a2); b2 = Φ (b0, b1); b 0 b 1 0 10 Exit a 0 SSA form CFG SSA Graph 11

Example: Building Value Search Graph Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions Φ {T,F} {T} a 3 b 0 1 0 Φ Φ SS Φ a 1 a 2 a 3 b 2 {F} {F} b 2 1 0 + {F} == {T,F} b 1 a 1 a 2 b 0 b 1 - + 0 10 {F} a 0 0 10 {T} Target nodes a 0 SSA Graph Value Search Graph Available nodes 12

Example: Building Value Search Graph Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions Φ State saving edges {T,F} {T} a 3 b 0 1 0 Φ Φ SS Φ a 1 a 2 a 3 b 2 {F} {F} b 2 1 0 + {F} == {T,F} b 1 a 1 a 2 b 0 b 1 - + 0 10 {F} a 0 0 10 {T} Target nodes a 0 SSA Graph Value Search Graph Available nodes 12

Example: Building Value Search Graph Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions Φ State saving edges {T,F} {T} a 3 b 0 1 0 Φ Φ SS Φ a 1 a 2 a 3 b 2 {F} {F} b 2 1 0 + {F} == {T,F} b 1 a 1 a 2 b 0 b 1 - + 0 10 {F} a 0 0 10 {T} Target nodes a 0 SSA Graph Value Search Graph Available nodes 12

Example: Building Route Graph Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions F {T,F} {T} T {F} {T} b 0 b 0 Φ Φ Φ SS SS a 3 b 2 b 2 F {F} {F} {F} 1 0 {F} {T,F} b 1 b 1 a 1 a 2 - - + F {F} {F} 0 10 0 10 {T} T {T} a 0 a 0 Route Graph 13

Example: Generating The Forward Program Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions void foo_forward() { {F} {T} b 0 int trace = 0; if (a == 0) Φ SS { b 2 trace |= 1; {F} a = 1; } b 1 else - { store(b); b = a + 10; {F} a = 0; 0 10 {T} } a 0 store(trace); } Route Graph Red: Path recording. Blue: State saving. 14

Example: Generating The Reverse Program Forward Value Original SSA form SSA Route and Search Function CFG Graph Graph Reverse Graph Functions {F} {T} b 0 void foo_reverse() { Φ SS int trace; b 2 restore(trace); {F} if ((trace & 1) == 1) a = 0; b 1 else - { a = b - 10; {F} restore(b); } 0 10 {T} } a 0 Route Graph 15

Example: Generated Forward And Reverse Programs void foo_forward() { int trace = 0; void foo_reverse() void foo() if (a == 0) { { { int trace; if (a == 0) trace |= 1; restore(trace); a = 1; a = 1; if ((trace & 1) == 1) else } a = 0; { else else b = a + 10; { { a = 0; store(b); a = b - 10; } b = a + 10; restore(b); } a = 0; } } } store(trace); } Red: Path recording. Blue: State saving. 16

Handling Loops • What problems do loops bring? • Cyclic control flow paths. • Solution: In the CFG, we collapse the loop into a single node and remove cycles. Also, we record the control flows in the loop body separately, where the loop body is treated as another loop-free program. 17

Handling Loops • Recording CFG paths for Programs with Loops Entry Entry Exit Exit 18

Handling Loops • What problems do loops bring? • Cyclic control flow paths. • Solution: In the CFG, we collapse the loop into a single node and remove cycles. Also, we record the control flows in the loop body separately, where the loop body is treated as another loop-free program. • If we want to build loops in the reverse program, cycles may be formed in the Route Graph. • Solution: we build special constructs in VSG for loops and also develop special searching rules. 19

Handling While Loops • While loop: a special single-entry single-exit loop. F A T B • For each variable modified in a while loop, we define four special definitions of it. v in in = μ (v in , v I v in : The input of the loop. in : The input of the iteration. v I out ); v I T v I out =...; v out : The output of the loop. out : The output of the iteration. while(...) v I F v out = η (v I in ); 20

Handling While Loops • Those four definitions in the VSG: • Forward edges represent data flows in the original (forward) programs. • Reverse edges represent data flows in the reverse programs. μ v I in η v in v out μ ' v I out forward edge reverse edge 21

Handling While Loops • Those four definitions in the VSG: • Forward edges represent data flows in the original (forward) programs. • Reverse edges represent data flows in the reverse programs. Initialization on μ v I in the first iteration η v in v out μ ' v I out forward edge reverse edge 21

Handling While Loops • Those four definitions in the VSG: • Forward edges represent data flows in the original (forward) programs. • Reverse edges represent data flows in the reverse programs. Initialization on μ v I in the first iteration η v in v out μ ' After each iteration, the v I out output becomes forward edge the input reverse edge 21

Handling While Loops • Those four definitions in the VSG: • Forward edges represent data flows in the original (forward) programs. • Reverse edges represent data flows in the reverse programs. Initialization on μ v I The output value in the first iteration of the loop is the η last definition of the mu node. v in v out μ ' After each iteration, the v I out output becomes forward edge the input reverse edge 21