Parallel Flow-Sensitive Pointer Analysis by Graph-Rewriting - - PowerPoint PPT Presentation

PACT'13

Parallel Flow-Sensitive Pointer Analysis by Graph-Rewriting

Vaivaswatha Nagaraj

• R. Govindarajan

Indian Institute of Science, Bangalore

PACT 2013

Vaivaswatha Nagaraj (IISc, Bangalore)

2

PACT'13

Outline

• Introduction
• Background
• Flow-sensitive graph-rewriting formulation
• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

3

PACT'13

Outline

• Introduction

Introduction

• Background
• Flow-sensitive graph-rewriting formulation
• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

4

PACT'13

Flow-sensitive pointer analysis

z points-to {?} z points-to {?}

z = x z = y x = &a y = &b

1 3 2 4

Vaivaswatha Nagaraj (IISc, Bangalore)

5

PACT'13

Flow-sensitive pointer analysis

z = y x = &a y = &b

x points-to a y points-to b

z = x

1 2 3 4 x points-to a y points-to b z points-to b x points-to a y points-to b z points-to a

Vaivaswatha Nagaraj (IISc, Bangalore)

6

PACT'13

Flow-sensitive vs flow-insensitive

z = y x = &a y = &b

x points-to a y points-to b x points-to a y points-to b z points-to {a,b} x points-to a y points-to b z points-to {a,b}

z = x

1 2 3 4

Vaivaswatha Nagaraj (IISc, Bangalore)

7

PACT'13

Outline

• Introduction
• Background

– Staged flow-sensitive analysis

Staged flow-sensitive analysis

– Graph-rewriting

• Flow-sensitive graph-rewriting formulation
• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

8

PACT'13

Staged flow-sensitive pointer analysis

• Scales to large programs
• Faster, less precise analysis used to speed up

the primary analysis

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

Vaivaswatha Nagaraj (IISc, Bangalore)

9

PACT'13

Staged flow-sensitive pointer analysis

• Scales to large programs
• Faster, less precise analysis used to speed up

the primary analysis

Our goal: Parallelize the staged flow-sensitive pointer analysis

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

Vaivaswatha Nagaraj (IISc, Bangalore)

10

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1

1 2 3 [Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

In a traditional analysis, points-to info of both a & b will be propagated to both 2 and 3

x1 points-to {a,b} a points-to {p,q} b points-to {r,s}

Vaivaswatha Nagaraj (IISc, Bangalore)

11

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1

1 2 3

y1 points-to {b} z1 points-to {a}

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

x1 points-to {a,b} a points-to {p,q} b points-to {r,s}

Vaivaswatha Nagaraj (IISc, Bangalore)

12

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1

1 2 3

Points-to info of only b is required here

y1 points-to {b} z1 points-to {a}

Points-to info of only a is required here

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

x1 points-to {a,b} a points-to {p,q} b points-to {r,s}

Vaivaswatha Nagaraj (IISc, Bangalore)

13

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1 *w1 = t2

1 2 3 4

How does staged analysis work?

(1) Use a fast analysis to get less precise points-to information

x1 →{a,b} z1 →{a} y1 →{b} w1 →{c}

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

Vaivaswatha Nagaraj (IISc, Bangalore)

14

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1 *w1 = t2

µ(a1) µ(b1) c2 = (c 

1)

a1 = (a 

0)

b1 = (b 

0)

1 2 3 4

How does staged analysis work?

(2) Use the less precise info to find variables potentially referenced at indirections (1) Use a fast analysis to get less precise points-to information

x1 →{a,b} z1 →{a} y1 →{b} w1 →{c}

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11]

Vaivaswatha Nagaraj (IISc, Bangalore)

15

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1 *w1 = t2

µ(a1) µ(b1) c2 = (c 

1)

a1 = (a 

0)

b1 = (b 

0)

1 2 3 4

How does staged analysis work?

[Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11] Flow-sensitivity - All variables in SSA form

Vaivaswatha Nagaraj (IISc, Bangalore)

16

PACT'13

Staged flow-sensitive analysis

v1 = *y1 w1 = *z1 *x1 = u1 *w1 = t2

µ(a1) µ(b1) c2 = (c 

1)

a1 = (a 

0)

b1 = (b 

0)

1 2 3 4

How does staged analysis work?

(3) Build def-use chains and propagate only along these chains Propagation of information is thus optimized [Flow-sensitive pointer analysis for millions of lines of code – Ben Hardekopf. et al. - CGO'11] Flow-sensitivity - All variables in SSA form

Vaivaswatha Nagaraj (IISc, Bangalore)

17

PACT'13

Parallelizing the staged analysis

Can the staged flow-sensitive pointer analysis be parallelized and scaled to multiple cores?

Vaivaswatha Nagaraj (IISc, Bangalore)

18

PACT'13

Towards a parallel algorithm

• Flow-insensitive pointer analysis has already

been parallelized#

• Parallelization of flow-insensitive analysis

involves transforming it to a graph-rewriting problem – expose amorphous data-parallelism

#[Parallel Inclusion-based Points-to Analysis - Mario Mendez-Lojo, et al. - OOPSLA'10]

Vaivaswatha Nagaraj (IISc, Bangalore)

19

PACT'13

Towards a parallel algorithm

• Flow-insensitive pointer analysis has already

been parallelized#

• Parallelization of flow-insensitive analysis

involves transforming it to a graph-rewriting problem – expose amorphous data-parallelism

#[Parallel Inclusion-based Points-to Analysis - Mario Mendez-Lojo, et al. - OOPSLA'10]

Our goal: Parallelize the staged flow-sensitive pointer analysis Formulate it as a graph-rewriting problem

Vaivaswatha Nagaraj (IISc, Bangalore)

20

PACT'13

Outline

• Introduction
• Background

– Staged flow-sensitive analysis – Graph-rewriting

Graph-rewriting

• Flow-sensitive graph-rewriting formulation
• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

21

PACT'13

Graph-rewriting

[Parallel Inclusion-based Points-to Analysis - Mario Mendez-Lojo, et al. - OOPSLA'10] x = &a x a p Points-to constraint Constraint graph y = x x y c

Vaivaswatha Nagaraj (IISc, Bangalore)

22

PACT'13

Graph-rewriting

x = &a x a p Points-to constraint Constraint graph y = x x y c x a p y c Apply rewrite-rule x a p y c p [Parallel Inclusion-based Points-to Analysis - Mario Mendez-Lojo, et al. - OOPSLA'10] Example: copy rewrite rule

Vaivaswatha Nagaraj (IISc, Bangalore)

23

PACT'13

Outline

• Introduction
• Background
• Flow-sensitive graph-rewriting formulation

Flow-sensitive graph-rewriting formulation

• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

24

PACT'13

Graph-rewriting formulation

v1 = *y1 w1 = *z1 *x1 = u1 *w1 = t2

µ(a1) µ(b1) c2 = (c 

1)

a1 = (a 

0)

b1 = (b 

0)

1 2 3 4

Graph: Nodes: Variables in the program Edges: Points-to, copy, load, store, etc ... Rewrite rules?

Vaivaswatha Nagaraj (IISc, Bangalore)

25

PACT'13

Challenges

• Spurious edges – leads to imprecision
• Strong and weak updates at store constraints

are not handled Directly using the flow-insensitive graph formulation for flow-sensitive analysis leads to the following challenges

Vaivaswatha Nagaraj (IISc, Bangalore)

26

PACT'13

Challenges

• Spurious edges – leads to imprecision

– Solution: potential edges

• Strong and weak updates at store constraints

are not handled

– Solution: klique nodes

Directly using the flow-insensitive graph formulation for flow-sensitive analysis leads to the following challenges

Vaivaswatha Nagaraj (IISc, Bangalore)

27

PACT'13

Outline

• Introduction
• Background
• Flow-sensitive graph-rewriting formulation

– Problem of spurious edges

Problem of spurious edges

– Handling strong and weak updates

• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

28

PACT'13

Spurious edges

• Load rule for flow-insensitive analysis:

y1 = &a x1 = *y1

Points-to constraints

Vaivaswatha Nagaraj (IISc, Bangalore)

29

PACT'13

Spurious edges

y1 a p x1 l Formulate graph

• Load rule for flow-insensitive analysis:

y1 = &a x1 = *y1

Points-to constraints

Vaivaswatha Nagaraj (IISc, Bangalore)

30

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

31

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph

• Loss of precision when used for flow-sensitive analysis:

x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

32

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p

y1 = &a x1 = *y1

Points-to constraints x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

33

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

34

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

35

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 a1 x1 l p a2 z1 l p c c

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

36

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 a1 x1 l p a2 z1 l p c c

Spurious edge

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

37

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 a1 x1 l p a2 z1 l p c c

Spurious edge

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

38

PACT'13

Spurious edges

y1 a p x1 l y1 a p x1 c l Apply load rule Formulate graph y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

y1 a1 x1 l p a2 z1 l p c c

Spurious edge

c

y1 = &a x1 = *y1

Points-to constraints

• Load rule for flow-insensitive analysis:
• Loss of precision when used for flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

39

PACT'13

Solution: Potential edges

• A potential edge of type t means that, there

could be an actual edge of type t, between the same two nodes

• Potential edges are added during initial graph

construction

• Some rewrite rules are modified to look for

potential edges

Vaivaswatha Nagaraj (IISc, Bangalore)

40

PACT'13

Solution: Potential edges

y1 a p x1 l Formulate graph p_c y1 a p x1 c l Modified load rule

• Modified load rule:

y1 = &a x1 = *y1

Vaivaswatha Nagaraj (IISc, Bangalore)

41

PACT'13

Solution: Potential edges

y1 a p x1 l Formulate graph p_c y1 a p x1 c l Modified load rule

• Modified rule applied to flow-sensitive analysis:

y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

p_c p_c

y1 = &a x1 = *y1

• Modified load rule:

Vaivaswatha Nagaraj (IISc, Bangalore)

42

PACT'13

Solution: Potential edges

y1 a p x1 l Formulate graph p_c y1 a p x1 c l Modified load rule y1 a1 x1 l p a2 z1 l p x1 = *y1

µ(a1)

z1 = *y1

µ(a2)

p_c p_c y1 a1 x1 l p a2 z1 l p c c

y1 = &a x1 = *y1

• Modified load rule:
• Modified rule applied to flow-sensitive analysis:

Vaivaswatha Nagaraj (IISc, Bangalore)

43

PACT'13

Outline

• Introduction
• Background
• Flow-sensitive graph-rewriting formulation

– Problem of spurious edges – Handling strong and weak updates

Handling strong and weak updates

• Implementation and Results
• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

44

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

As the flow-sensitive analysis progresses:

Vaivaswatha Nagaraj (IISc, Bangalore)

45

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

As the flow-sensitive analysis progresses:

How to update a1?

Vaivaswatha Nagaraj (IISc, Bangalore)

46

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

As the flow-sensitive analysis progresses:

x1 points-to {a1}

How to update a1?

Vaivaswatha Nagaraj (IISc, Bangalore)

47

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

As the flow-sensitive analysis progresses:

x1 points-to {a1} a1 ↵ u1

Strong Update

How to update a1?

Vaivaswatha Nagaraj (IISc, Bangalore)

48

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

As the flow-sensitive analysis progresses:

x1 points-to {a1} a1 ↵ u1

Strong Update

x1 points-to {a1,b1}

How to update a1?

Vaivaswatha Nagaraj (IISc, Bangalore)

49

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

As the flow-sensitive analysis progresses:

x1 points-to {a1} a1 ↵ u1

Strong Update

x1 points-to {a1,b1} a1 ↵ u1 ∪ a0

Weak Update

How to update a1?

Vaivaswatha Nagaraj (IISc, Bangalore)

50

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

update a1 as

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if

Vaivaswatha Nagaraj (IISc, Bangalore)

51

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

update a1 as

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if

Points-to set of a1 depends

• n whether x1 points-to b1

Vaivaswatha Nagaraj (IISc, Bangalore)

52

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

update a1 as

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if

Points-to set of a1 depends

• n whether x1 points-to b1

Connect a1 and b1

Vaivaswatha Nagaraj (IISc, Bangalore)

53

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

a1 b1 Solution: Connect all variables on the LHS of , within a store. Use a klique node as the common connection. k

klique node ⇔ store constraint

1-1

Vaivaswatha Nagaraj (IISc, Bangalore)

54

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if

update a1 as

Vaivaswatha Nagaraj (IISc, Bangalore)

55

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if Rewrite rule to update a1:

update a1 as

x1 a1 p u1 s p_c x1 a1 p u1 s c

Vaivaswatha Nagaraj (IISc, Bangalore)

56

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if

update a1 as

Vaivaswatha Nagaraj (IISc, Bangalore)

57

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if Rewrite rule to update a1: (2 steps)

update a1 as

x1 b1 p

Note: The rewrite rule shown here is not complete.

k1 b1

Vaivaswatha Nagaraj (IISc, Bangalore)

58

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if Rewrite rule to update a1: (2 steps)

update a1 as

x1 b1 p

Note: The rewrite rule shown here is not complete.

k1 b1 k1 b1 a0 a1 c k1

Vaivaswatha Nagaraj (IISc, Bangalore)

59

PACT'13

Strong and weak updates

*x1 = u1

a1 = (a 

0)

b1 = (b 

0)

if x1 points-to a then a1 ↵ u1 end if if x1 points-to b then a1 ↵ a0 end if

update a1 as

Handled

Vaivaswatha Nagaraj (IISc, Bangalore)

60

PACT'13

Applying the rewrite rules

• Rewrite rules can be applied in any order, and

to any node

• Rewrite rules are applied until fixed point
• At any time, there may be multiple nodes

ready for rewrite rule application, allowing parallel application of rewrite rules

Vaivaswatha Nagaraj (IISc, Bangalore)

61

PACT'13

Outline

• Introduction
• Background
• Flow-sensitive graph-rewriting formulation
• Implementation and Results

Implementation and Results

• Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

62

PACT'13

Implementation details

• Intel threading building blocks (TBB) used to

manage parallel workload

• A dual-worklist based approach to keep track
• f nodes for processing
• A hash table based concurrent data structure

(concurrent_unordered_set), provided by TBB used to represent graph edges

Vaivaswatha Nagaraj (IISc, Bangalore)

63

PACT'13

Machine configuration

• 4-socket machine
• 2.0 GHz, 8-core processor on each socket
• 64GB memory
• Debian GNU/Linux 6.0
• Intel Threading Building Blocks – 4.0

Vaivaswatha Nagaraj (IISc, Bangalore)

64

PACT'13

Benchmarks

All of these have been used in previous pointer analysis experiments

Benchmark Number of graph nodes

Larger (lines of code) programs from SPEC2006 13k - 414k Ex – text processor 19k Nethack – text based game 222k Sendmail – email server 71k SVN – revision control system 6439k Vim – text editor 1265k

Vaivaswatha Nagaraj (IISc, Bangalore)

65

PACT'13

Scaling

Vaivaswatha Nagaraj (IISc, Bangalore)

66

PACT'13

Outline

• Introduction
• Background
• Flow-sensitive graph-rewriting formulation
• Implementation and Results
• Conclusion

Conclusion

Vaivaswatha Nagaraj (IISc, Bangalore)

67

PACT'13

Conclusion

• First parallelization of precise flow-sensitive

pointer analysis

• Flow-sensitive pointer analysis as a graph-

rewriting problem – easy to take advantage

• f amorphous data parallelism
• Scaling of up to 6.9x, for 8 threads shown

Vaivaswatha Nagaraj (IISc, Bangalore)

68

PACT'13

Acknowledgement

• PACT student travel grant
• GARP student grant - IISc
• Ben Hardekopf and Mario Mendez-Lojo
• Rupesh Nasre
• HPC lab members – SERC – IISc

Vaivaswatha Nagaraj (IISc, Bangalore)

69

PACT'13

Thank you

Questions?

Vaivaswatha Nagaraj (IISc, Bangalore)

70

PACT'13

Backup: recent results – combine worklists

ex 254.gap 176.gcc nethack 253.perl 197.parser sendmail vim svn 255.vortex 0.5 1 1.5 2 2.5 3 3.5 4 4.5 1 thread 2 threads 4 threads 6 threads 8 threads

speedup

6 . 8 x 5 . 3 8 x

Vaivaswatha Nagaraj (IISc, Bangalore)

71

PACT'13

Backup: – Comparison with SFS

Vaivaswatha Nagaraj (IISc, Bangalore)

72

PACT'13

Backup: Program size

Vaivaswatha Nagaraj (IISc, Bangalore)

73

PACT'13

Backup: – Average worklist size

(a) .. (h) are worklists for each rewrite rule

Vaivaswatha Nagaraj (IISc, Bangalore)

74

PACT'13

Backup: - Future work

• Explore different orders of applying rewrite

rules

• Reordering nodes for locality might give

better scaling

• Extend for context-sensitivity
• Using concurrent sparse-bit-vectors for

representing edges may improve performance