Synthesizing Loops For Program Inversion Cong Hou, Daniel Quinlan, - - PowerPoint PPT Presentation

Synthesizing Loops For Program Inversion

Cong Hou, Daniel Quinlan, David Jefferson, Richard Fujimoto, Richard Vuduc

For RC 2012

Program Inversion

• Given a program P, and its inverse P-, then we have

P ; P- = no-op

• Examples: ++a/--a, swap(a,b)/swap(a,b), compression/

decompression, encryption/decryption, etc..

• Assume the input and output of P are IN and OUT:

2

IN OUT

P P-

Reverse program

Program Inversion

• What if P is not reversible?

IN: a a = 0; OUT: a

3

P

Program Inversion

• What if P is not reversible?

IN: a a = 0; OUT: a

3

• Make it reversible!

IN: a s = a; a = 0; OUT: a, s IN: a, s a = s; OUT: a

P+ P- P

Program Inversion

• What if P is not reversible?

IN: a a = 0; OUT: a

3

• Make it reversible!

IN: a s = a; a = 0; OUT: a, s IN: a, s a = s; OUT: a

P+ P- P

State Saving

Program Inversion

• What if P is not reversible?

IN: a a = 0; OUT: a

3

• Make it reversible!

IN: a s = a; a = 0; OUT: a, s IN: a, s a = s; OUT: a

P+ P- P

IN OUT+S

P+ P-

Reverse program Forward program State Saving

Our Previous Work

• We have built a framework that can generate the forward and

reverse programs for loop-free programs.

• We have implemented this framework into a compiler called

Backstroke.

• For more details please refer to our CC paper:
• C. Hou, G. Vulov, D. Quinlan, D. Jefferson, R. Fujimoto, and R. Vuduc. A

new method for program inversion. International Conference on Compiler Construction, 2012.

4

Overview Of Our Previous Work

• Our approach:

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

5

Overview Of Our Previous Work

• We turn the program into the SSA (Static Single Assignment)

form CFG (Control Flow Graph), so that each variable is defined

• nly once and can represent a distinct value. An SSA graph is then

built to show the data dependencies between different values.

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

6

Overview Of Our Previous Work

• We build a Value Search Graph (VSG) showing all equality

relations between values in the program. Finding the inverse becomes a search problem in this graph. Each equality is constrained by a condition represented by a set of CFG paths.

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

7

Overview Of Our Previous Work

• We then search for the desired values by following the equalities

until available values are reached. The search should guarantee that each value is retrieved for all CFG paths. The search result which we call a Route Graph (RG) shows valid data dependences in reverse program.

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

8

Overview Of Our Previous Work

• The forward and reverse programs are built based on the search

result.

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

9

Example: Building SSA Form CFG

IN: a, b void foo() { if (a == 0) a = 1; else { b = a + 10; a = 0; } } OUT: a, b

Entry if (a0 == 0) b1 = a0 + 10; a2 = 0; a1 = 1; a3 = Φ(a1, a2); b2 = Φ(b0, b1); F T Exit

SSA form CFG

10

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Building SSA Graph

Entry if (a0 == 0) b1 = a0 + 10; a2 = 0; a1 = 1; a3 = Φ(a1, a2); b2 = Φ(b0, b1); F T Exit

a0 b0

10

+ b1

1

a1 a2 Φ a3 Φ b2

==

SSA Graph SSA form CFG

11

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Building Value Search Graph

a0 b0

10

+ b1

1

a1 a2 Φ a3 Φ b2

==

a0 b0

10

b1

1

a1 a2 Φ a3 Φ b2 +

• SS

{T} {T,F} {F} {T,F} {F} {F} {T} {F}

SSA Graph Value Search Graph

Target nodes Available nodes

12

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Building Value Search Graph

a0 b0

10

+ b1

1

a1 a2 Φ a3 Φ b2

==

a0 b0

10

b1

1

a1 a2 Φ a3 Φ b2 +

• SS

{T} {T,F} {F} {T,F} {F} {F} {T} {F}

SSA Graph Value Search Graph

State saving edges

Target nodes Available nodes

12

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Building Value Search Graph

a0 b0

10

+ b1

1

a1 a2 Φ a3 Φ b2

==

a0 b0

10

b1

1

a1 a2 Φ a3 Φ b2 +

• SS

{T} {T,F} {F} {T,F} {F} {F} {T} {F}

SSA Graph Value Search Graph

State saving edges

Target nodes Available nodes

12

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Building Route Graph

a0 b0

10

b1

1

a1 a2 Φ a3 Φ b2 +

• SS

{T} {T,F} {F} {T,F} {F} {F} {T} {F}

T F F T F

a0 b0

10

b1 Φ b2

• SS

{T} {F} {F} {T} {F}

Route Graph

13

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Generating The Forward Program

void foo_forward() { int trace = 0; if (a == 0) { trace |= 1; a = 1; } else { store(b); b = a + 10; a = 0; } store(trace); }

Red: Path recording. Blue: State saving.

14

a0 b0

10

b1 Φ b2

• SS

{T} {F} {F} {T} {F}

Route Graph

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Generating The Reverse Program

15

a0 b0

10

b1 Φ b2

• SS

{T} {F} {F} {T} {F}

Route Graph

void foo_reverse() { int trace; restore(trace); if ((trace & 1) == 1) a = 0; else { a = b - 10; restore(b); } }

Original Function SSA form CFG SSA Graph Value Search Graph Route Graph Forward and Reverse Functions

Example: Generated Forward And Reverse Programs

void foo_forward() { int trace = 0; if (a == 0) { trace |= 1; a = 1; } else { store(b); b = a + 10; a = 0; } store(trace); } void foo_reverse() { int trace; restore(trace); if ((trace & 1) == 1) a = 0; else { a = b - 10; restore(b); } } void foo() { if (a == 0) a = 1; else { b = a + 10; a = 0; } }

Red: Path recording. Blue: State saving.

16

Handling Loops

• What problems do loops bring?
• Cyclic control flow paths.
• Solution: In the CFG, we collapse the loop into a single node and

remove cycles. Also, we record the control flows in the loop body separately, where the loop body is treated as another loop-free program.

17

Handling Loops

• Recording CFG paths for Programs with Loops

18

Entry Exit Entry Exit

Handling Loops

• What problems do loops bring?
• Cyclic control flow paths.
• Solution: In the CFG, we collapse the loop into a single node and

remove cycles. Also, we record the control flows in the loop body separately, where the loop body is treated as another loop-free program.

• If we want to build loops in the reverse program, cycles may be

formed in the Route Graph.

• Solution: we build special constructs in VSG for loops and also develop

special searching rules.

19

Handling While Loops

• While loop: a special single-entry single-exit loop.
• For each variable modified in a while loop, we define four special

definitions of it.

20 A B

T F

vin vI

in = μ(vin, vI

• ut);

while(...) vI

• ut =...;

vout= η(vI

in);

T F

vin: The input of the loop. vout: The output of the loop. vI

in: The input of the iteration.

vI

• ut: The output of the iteration.

Handling While Loops

• Those four definitions in the VSG:
• Forward edges represent data flows in the original (forward) programs.
• Reverse edges represent data flows in the reverse programs.

21

μ

vI

in

vin

μ'

vI

• ut

η

vout

forward edge reverse edge

Handling While Loops

• Those four definitions in the VSG:
• Forward edges represent data flows in the original (forward) programs.
• Reverse edges represent data flows in the reverse programs.

21

μ

vI

in

vin

μ'

vI

• ut

η

vout

forward edge reverse edge

Initialization on the first iteration

Handling While Loops

• Those four definitions in the VSG:
• Forward edges represent data flows in the original (forward) programs.
• Reverse edges represent data flows in the reverse programs.

21

μ

vI

in

vin

μ'

vI

• ut

η

vout

forward edge reverse edge

Initialization on the first iteration After each iteration, the

• utput becomes

the input

Handling While Loops

• Those four definitions in the VSG:
• Forward edges represent data flows in the original (forward) programs.
• Reverse edges represent data flows in the reverse programs.

21

μ

vI

in

vin

μ'

vI

• ut

η

vout

forward edge reverse edge

Initialization on the first iteration After each iteration, the

• utput becomes

the input The output value

• f the loop is the

last definition of the mu node.

Handling While Loops

• Special search rules on the VSG:
• Allows cycles to be formed. But each cycle must contain a forward/reverse edge

between the input and output of the iteration.

• During the search for a given value, the forward and reverse edges cannot

coexist in the search result.

22

μ

vI

in

vin

μ'

vI

• ut

η

vout

Handling While Loops

• Building the loop body.
• Using the same method we build the reverse code for loop-free programs.
• Building the loop predicate.
• Approach 1: Building the same loop predicate as in the original loop.
• Approach 2: If there is a monotonic variable in a loop, build the loop predicate from

it.

• Approach 3: Insert a counter counting the number of iterations of the loop in the

forward program, and use this counter to build the loop predicate in the reverse program.

23

Handling While Loops

• Building the loop predicate.
• Approach 1: Building the same loop predicate as in the original loop.

24

i = 0; while (A[i] > 0) { /* ... */ i = i + 2; } i = 0; while (A[i] > 0) { /* generated loop body */ i = i + 2; }

Original loop Generated loop

Handling While Loops

• Building the loop predicate.
• Approach 2: If there is a monotonic variable in a loop, build the loop predicate from

it.

25

i = 0; while (A[i] > 0) { /* ... */ i = i + 2; } /* i == i1 */ i = 0; while (i != i1) { /* generated loop body */ i = i + 2; }

Original loop Generated loop

Handling While Loops

• Building the loop predicate.
• Approach 3: Insert a counter counting the number of iterations of the loop in the

forward program, and use this counter to build the loop predicate in the reverse program.

26

i = 0; count = 0; while (A[i] > 0) { /* ... */ i = i + 2; count = count + 1; } store(count); restore(count); while (count > 0) { /* generated loop body */ count = count - 1; }

Original loop Generated loop

An Example

• Our example: Given an integer n (n > 0), get 1+2+...+n.

27

// input: n (n > 0) s = 0; while (n > 0) { s = s + n; n = n - 1; } // output: s

s0 = 0; s1 = μ(s0, s2); n1 = μ(n0, n2); while(n1 > 0) s2 = s1 + n1; n2 = n1 - 1; s3 = η(s1); n3 = η(n1);

T F

CFG in SSA form The loop example

An Example

• The search result of our example.

28

μ' n2 η n3 μ n1 n0

• s0

μ s1 μ' s2 η s3

• μ'

n2 η n3 μ n1 n0

• s0

μ s1 μ' s2 η s3

• μ'

n2 η n3 μ n1 n0

• s0

μ s1 μ' s2 η s3

• Available node

Target node Forward edge Reverse edge

An Example

• The original and generated loop:

29

n = 0; while (s != 0) { n = n + 1; s = s - n; } s = 0; while (n > 0) { s = s + n; n = n - 1; }

The original loop The generated loop

Handling Other Loops

• We only consider natural loops (loops with single-entry).
• A non-while loops may be:
• A loop with several exits.
• The entry and exit are at different nodes.

30

2 3 4 5 6 1 2 3 4 5 6 1 2' 3' 4' 5' 1' F T 7 7 T F

Current And Future Work

• We are working on reversing programs with arrays. Specifically,

we are interested in automatically reverse some injective programs like compression/decompression programs.

• We will research on how to rebuild the control flows in the reverse

program without path recording.

• Questions?

31