The PPA Algorithm

60
The PPA Algorithm Jeff Da Silva September 10 th , 2004

description

The PPA Algorithm. Jeff Da Silva September 10 th , 2004. *A = ~. ~ = *B. The Pointer Alias Analysis Problem. Statically decide for any pair of pointers, at any point in the program, whether two pointers point to the same memory location. *A = ~ ~ = *B. Pointer Analysis Issues. - PowerPoint PPT Presentation

Transcript of The PPA Algorithm

Page 1: The PPA Algorithm

The PPA Algorithm Jeff Da SilvaSeptember 10th, 2004

Page 2: The PPA Algorithm

The Pointer Alias Analysis Problem

Statically decide for any pair of pointers, at any point in the program, whether two pointers point to the same memory location.

*A = ~ ~ = *B

*A = ~ ~ = *B

Page 3: The PPA Algorithm

Pointer Analysis Issues Scalability vs. Accuracy

Generally, a ‘difficult’ tradeoff exists between: the amount of computation and memory required vs. the accuracy of the analysis.

Precision/Efficiency tradeoff, where is the sweet spot? Which metric should be used?

Direct metric Report performance applied to an optimization Dynamically measure false positives

Which benchmark suite? Are the results reproducible?

Page 4: The PPA Algorithm

Pointer Analysis Issues

Complications associated with pointer arithmetic, casting, function pointers, long jumps, and multithreaded applications. Can these be ignored?

Different pointer analysis uses have different needs. A universal pointer analysis probably doesn’t exist.

Page 5: The PPA Algorithm

Pointer Analysis Design Choices

Flow sensitivity Context sensitivity Heap modeling Aggregate modeling Alias representation Whole program Incremental compilation

Page 6: The PPA Algorithm

Accuracy/Efficiency Tradeoff

• Linear Time Complexity• Inaccurate - many false ‘maybe’ outputs• Memory Required: Negligible

• Doubly Exponential• Accurate – very few ‘maybe’ outputs (control deps/runtime)• Requires Entire Program Info• Memory Required: Oodles• Does not scale well

Probabilistic Pointer Analysis (PPA)

• Polynomial Time Complexity (guessing)• Inaccurate – many false ‘maybe’ outputs, but provides approximate probability metric• Does not require entire program• Memory Required: yet to be determined• Scalable

SPAN

Chen, et al: Only Other PPA

Steensgaard

Address-taken

BDD based

Page 7: The PPA Algorithm

PPA Algorithm Objectives An Interprocedural, Flow Sensitive, Context

Sensitive/Merged approach that uses Transfer Functions.

Must be scalable and should require less space and time than any traditional analysis.

Provide an approximate probability for the ‘Maybe’ output.

Page 8: The PPA Algorithm

Design Choices (tentative)

Flow sensitivity: flow sensitive Context sensitivity: context merged Heap modeling: allocation site Aggregate modeling: arrays aggregated, structs

separated Alias representation: points-to Whole program: not required Incremental compilation: limited support

Page 9: The PPA Algorithm

How is Probabilistic Pointer Analysis used?

SpeculativeParallelized Executable

Source Code

Speculative Parallelizing

(TLS) Compiler

ProbabilisticDependence

Analysis

DynamicProfiling

ProbabilisticPointer

Analysis

Page 10: The PPA Algorithm

The Probabilistic Pointer Analysis (PPA) Problem

Probabilistic Pointer Analysis (PPA): For any pair of pointers, at any point in the program, statically estimate the probability that two pointers point to the same memory location.

*A = ~ ~ = *B

*A = ~ ~ = *B

Page 11: The PPA Algorithm

The Traditional Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

r s t

x y z

a b c

Page 12: The PPA Algorithm

The Traditional Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) x=&s; s=&c;

r s t

x y z

a b c

Page 13: The PPA Algorithm

The Traditional Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) x=&s; s=&c;

r=&b; z=&r;

r s t

x y z

a b c

Page 14: The PPA Algorithm

The Traditional Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) x=&s; s=&c;

r=&b; z=&r;

if(…) y = x;

r s t

x y z

a b c

Page 15: The PPA Algorithm

The Traditional Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) x=&s; s=&c;

r=&b; z=&r;

if(…) y = x;

*x = &a;

r s t

x y z

a b c

Page 16: The PPA Algorithm

The Probabilistic Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

r s t

x y z

a b c

1.0 1.0

1.0 1.0 1.0

1.0

Page 17: The PPA Algorithm

The Probabilistic Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) /*60% taken*/

x=&s; s=&c;r s t

x y z

a b c

0.60.4

0.60.4

Page 18: The PPA Algorithm

The Probabilistic Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) /*60% taken*/

x=&s; s=&c;

r=&b; z=&r;

r s t

x y z

a b c

0.60.4

0.6

0.4

Page 19: The PPA Algorithm

The Probabilistic Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) /*60% taken*/

x=&s; s=&c;

r=&b; z=&r;

if(…) /*10% taken*/

y = x;

r s t

x

y

z

a b c

0.6

0.4

0.6

0.4

0.040.96

Page 20: The PPA Algorithm

The Probabilistic Points-To Graph

int a, b, c;int *r, *s, *t;int **x, **y, **z;

x=&r; y=&s; z=&t; r=&a; s=&b; z=&c;

if(…) /*60% taken*/

x=&s; s=&c;

r=&b; z=&r;

if(…) /*10% taken*/

y = x;

*x = &a;

r s t

xy

z

a b c

0.6

0.4

0.96

0.04

0.6

0.40.4

0.60.6

0.240.16

What is the probability that **y points to a?

Page 21: The PPA Algorithm

A Probabilistic Points-To Matrix

r s t

xy

z

a b c

0.6

0.4

0.96

0.04

0.4

0.60.6

0.24

0.16

x y z r s t a b c

x 0.0 0.0 0.0 0.4 0.6 0.0 0.0 0.0 0.0

y 0.0 0.0 0.0 .04 .96 0.0 0.0 0.0 0.0

z 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

r 0.0 0.0 0.0 0.0 0.0 0.0 0.4 0.6 0.0

s 0.0 0.0 0.0 0.0 0.0 0.0 0.6 .16 .24

t 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

a 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

b 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

c 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

Page 22: The PPA Algorithm

My PPA AlgorithmPPA Algorithm Goal: For each program point generate a probabilistic

points-to graph that specifies, for each pointer, the set of probabilities that it points to each location.

Page 23: The PPA Algorithm

Definition: Probability Analysis Let <p,v> denote a points-to relationship from a pointer

p to a location v. At every static program point s there exists a probability

function P(s, <p,v>) that denotes the probability that p points to v during dynamic program execution.

P(s, <p,v>) = D(s, <p,v>) / D(s)

Where D(s) is the number of times s is (expected to be) dynamically visited and D(s, <p,v>) is the number of times that the points-to relation <p,v> dynamically holds.

Page 24: The PPA Algorithm

Conservative Probability My algorithm is a may alias conservative

analysis. A probability of 0.0 [P(s,<p,v>) = 0.0] indicates that a points-to

relation <p,v> will never hold. The converse is not true.

A probability of 1.0 [P(s,<p,v>) = 1.0] indicates that a points to relation <p,v> will always hold. The converse is not necessarily true: a dynamic points-to

relationship <p,v> that always exists may not be reported with a probability of 1.0.

Page 25: The PPA Algorithm

Location Sets Each node in the graph is implemented with a location

set, which is a triple of the form <name, offset, stride> consisting of: a variable name that describes the memory block, an offset within that block and a stride that characterizes the recurring structure of data vectors (in bytes).

a <a, 0, 0>

b.f <b, f, 0>

c[i] <c, 0, 4>

d[i].g <d, g,12>

struct ds { int e,f,g;}…int a;struct ds b;int c[100]struct ds d[100];

Aggregate modeling: arrays aggregated, structs separated

Page 26: The PPA Algorithm

Special Location Sets Each dynamic memory allocation site has its own name.

Eg: the location set that represents a field f in a structure dynamically located at site s is <s, f, 0>.

Additional Location Sets UND: undefined UNK: unknown NULL: C null

Page 27: The PPA Algorithm

Basic Pointer Assignment Transformations

x = &y Address-of Assignment

x = y Copy Assignment

x = *y Load Assignment

*x = y Store Assignment

Ignoring pointer arithmetic and casting for now.

Page 28: The PPA Algorithm

PPA Let Xs represent the probabilistic points-to graph/matrix

at a specific program point s.

Basic pointer assignment instruction

XIN

XOUT

Claim: There exists a transformation function T(X) for every instruction i, such that XOUT = Ti(XIN).

Page 29: The PPA Algorithm

Linear Transformations A transformation T(X) is linear iff the following

relationships hold for all points-to matrices U and V: T(U+V) = T(U) + T(V) T(cU) = cT(U)

If TB and TA are linear transformations represented by the matrices B and A respectively, then: TB(TA(X)) = [B][A][X]

Page 30: The PPA Algorithm

Linear Points-To Representation A points-to matrix is used to represent the points-to

graph.

Matrix row/column labeling: Locations sets are denoted with L<id> Pointers are denoted with P<id>

Rules for linearity: Pointers can only point to Location sets Location sets always point to themselves with probability

1.0 All rows sum to 1.0

Page 31: The PPA Algorithm

Linear Points-To Representation

int *a; /*L1, P1*/

int *b; /*L2, P2*/

int x[N]; /*L3*/

int y[N]; /*L4*/

int *tmp; /*L5, P5*/

~ = (int*)calloc(N, sizeof(int)) /*L6*/;

UND

aa

x

bb tmptmp

NULL UNKy

allocL6

Page 32: The PPA Algorithm

Linear Points-To Representation

int *a; /*L1, P1*/

int *b; /*L2, P2*/

int x[N]; /*L3*/

int y[N]; /*L4*/

int *tmp; /*L5, P5*/

~ = (int*)calloc(N, sizeof(int)) /*L6*/;

UND

P1L1

L3

P2L2

NULL UNKL4 L6

P5L5

Page 33: The PPA Algorithm

Points-To Matrix

int *a; /*L1, P1*/

int *b; /*L2, P2*/

int x[N]; /*L3*/

int y[N]; /*L4*/

int *tmp; /*L5, P5*/

~ = (int*)calloc(N, sizeof(int)) /*L6*/;

P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK

P1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

P2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

P5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0

L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0

UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0

UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

Page 34: The PPA Algorithm

Points-To Matrix PropertiesP1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK

P1 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

P2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

P5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0

L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0

UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0

UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

Ø

Page 35: The PPA Algorithm

The Transformation Matrix For every Basic Pointer Assignment there exists a linear

transformation matrix T such that:

XOUT = TXIN

Basic pointer assignment instruction

XIN

XOUT

Page 36: The PPA Algorithm

The Pointer Assignment Operation

x = &y Address-of Assignment Px -> Ly

x = y Copy Assignment Px -> Py

MATLAB code:

% PPA_ptra: Probabilistic Pointer Analysis pointer assignment function% Returns the PPA ptr assignment transformation matrix

function T = PPA_ptra(ptr, loc, N) T = eye(N); T(ptr,ptr) = 0.0; T(ptr,loc) = 1.0;

Page 37: The PPA Algorithm

Pointer Assignment Example

P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK

P1 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

P2 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

P5 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0

L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0

UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0

UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/

tmp = a;

S1: P5 -> P1;

T(P5->P1) =

TS1 = eye(12);Ts1(P5,P5) = 0.0Ts1(P5,P1) = 1.0

Page 38: The PPA Algorithm

Pointer Assignment Example

P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK

P1 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

P2 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

P5 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0

L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0

UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0

UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/

a = x;

S2: P1 -> L3;

T(P1->L3) =

TS2 = eye(12);Ts2(P1,P1) = 0.0Ts2(P1,L3) = 1.0

Page 39: The PPA Algorithm

Combining Transformation Matrices

XOUT = T2 T1 XIN

T2: Basic pointer assignment instruction

XIN

XOUT

T1: Basic pointer assignment instruction

Page 40: The PPA Algorithm

Combining Pointer Assignment Example

P1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK

P1 0.0 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

P2 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

P5 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0

L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0

UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0

UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/

void swap { tmp = a; a = b; b = tmp;}

S1: P5 -> P1S2: P1 -> P2S3: P2 -> P5

Tswap = TS3 TS2 TS1

Page 41: The PPA Algorithm

Combining Pointer Assignment Example

UND

P1L1

L3

P2L2

NULL UNKL4 L6

P5L5

UND

P1L1

L3

P2L2

NULL UNKL4 L6

P5L5Tswap

Page 42: The PPA Algorithm

Combining Pointer Assignment Example

UND

P1L1

L3

P2L2

NULL UNKL4 L6

P5L5

UND

P1L1

L3

P2L2

NULL UNKL4 L6

P5L5Tswap

0.90.1 0.7 0.3

0.90.1

0.90.10.7

0.3

Page 43: The PPA Algorithm

Control flow and loops Loops are found and back edges are labeled with there

back edge count. [assume all loops have constant trip count for now]

Denoted with a capital letter

All other edges are labeled with there basic block fan-in probability that sums to 1. Denoted with a small case letter

A

p

q

r

N

Page 44: The PPA Algorithm

The Effect of Control Flow

A = TA

A= TC [pTBTA + qTA]

C

Bp

q

Page 45: The PPA Algorithm

The Effect of Control Flow

A

= TD [pTB + qTC] TA

D

Bp q

C

Page 46: The PPA Algorithm

The Effect of Control Flow

A

= Tc [p1TB1 + p2TB2 + … + pnTBn] TA

C

B1

p1 pn

BnB2

p2

Page 47: The PPA Algorithm

ExampleP1 P2 P5 L1 L2 L3 L4 L5 L6 UND Null UNK

P1 0.9 0.1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

P2 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

P5 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L1 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L2 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0

L3 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0 0.0

L4 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0 0.0

L5 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 0.0

L6 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0

UND 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0 0.0

Null 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0 0.0

UNK 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.0

int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/

void might_alias { if(!RANDOM(10)) a = b;}

BB1:if() /*0.1*/ BB2: S1: P1 -> P2fiBB3:

Tmight_alias = TBB3 [0.1 TBB2 TBB1 + 0.9 TBB1]

Page 48: The PPA Algorithm

Loops – Constant Trip Count

A = TA[TA]N = [TA]N+1 N

A = [ TB [TA]N+1 ]M+1

NB M

Page 49: The PPA Algorithm

Loop Transformation types Identity Converges Periodic Converges and Periodic

for(i=0;i<N;i++){ if(!RANDOM(10)) { a = b; }}

for(i=0;i<N;i++){ swap();}

for(i=0;i<N;i++){ if(RANDOM(10)) { a = b; swap(); }}

P1 P2

P1 0.9N 0.1N

P2 1.0 …

P1 P2

P1 0.0 1.0

P2 1.0 0.0

P1 P2

P1 1.0 0.0

P2 0.0 1.0

If Odd

If Even

Page 50: The PPA Algorithm

Loops – Non-Constant Trip Count

A = 1/(N+1) [ [TA]0 + [TA]1 + … + [TA]N] ] N

Geometric Series Transform [gstr] operation

= gstr(TA, 0, N)

Page 51: The PPA Algorithm

The Characterization Matrix

for(i=0;i<N-1;i++){ if(!RANDOM(10000)) { swap(); b = a; } a[i] = x[i+1];}

XIN

XOUT

XOUT = [Tloop_inner]N-1

Xchar = Tloop_inner x gstr(Tloop_inner, 0, N-1)

Page 52: The PPA Algorithm

Example Results

void swap() { tmp = a; a = b; b = tmp; return;}

void might_alias(){ if(!RANDOM(10)) /*10% taken*/ a = b;}

int *a; /*L1, P1*/int *b; /*L2, P2*/int x[N]; /*L3*/int y[N]; /*L4*/int *tmp; /*L5, P5*/

L3 L4 L6 UND

P1 ? ? ? ?

P2 ? ? ? ?

PTM

Page 53: The PPA Algorithm

Example Resultsint main() {

a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;

for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }

/*does a point to x*/ for(i=0;i<N-1;i++) if(!RANDOM(10000)) /*0.01% taken*/ { swap(); b = a; } a[i] = x[i+1]; /*assume lots of other work as well...*/ } return 0;}

Page 54: The PPA Algorithm

Example Resultsint main() {

a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;

for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }

L3 L4 L6 UND

P1 0.0 0.0 0.0 1.0

P2 0.0 0.0 0.0 1.0

PTM - Matlab

L3 L4 L6 UND

P1 0.0 0.0 0.0 1.0

P2 0.0 0.0 0.0 1.0

PTM - Simulation

Page 55: The PPA Algorithm

Example Resultsint main() {

a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;

for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }

L3 L4 L6 UND

P1 0.1 0.9 0.0 0.0

P2 0.0 0.0 1.0 0.0

PTM - Matlab

L3 L4 L6 UND

P1 0.10 0.90 0.0 0.0

P2 0.0 0.0 1.0 0.0

PTM - Simulation

Page 56: The PPA Algorithm

Example Resultsint main() {

a = x; b = y; swap(); might_alias(); b = (int*)calloc(N, sizeof(int))/*L6*/;

for(i=0;i<RANDOM(9);i++) { if(RANDOM(10)) /*90% taken*/ { b = x; a = y; } else { for(j=0;j<3;j++) swap(); } }

L3 L4 L6 UND

P1 0.081 0.907 0.013 0.0

P2 0.794 0.079 0.126 0.0

PTM - Matlab

L3 L4 L6 UND

P1 0.08 0.90 0.02 0.0

P2 0.81 0.08 0.11 0.0

PTM - Simulation

Page 57: The PPA Algorithm

Example Results

L3 L4 L6 UND

P1 0.149 0.828 0.023 0.0

P2 0.814 0.072 0.114 0.0

PTM - Matlab

L3 L4 L6 UND

P1 0.14 0.83 0.03 0.0

P2 0.81 0.08 0.11 0.0

PTM - Simulation

/*does a point to x*/ for(i=0;i<N-1;i++) if(!RANDOM(10000)) /*0.01% taken*/ { swap(); b = a; } a[i] = x[i+1]; /*assume lots of other work as well...*/ } return 0;}

Page 58: The PPA Algorithm

Example Results

L3 L4 L6 UND

P1 0.115 0.867 0.018 0.0

P2 0.804 0.076 0.120 0.0

PTM-CHA - Matlab

L3 L4 L6 UND

P1 0.11 0.87 0.02 0.0

P2 0.81 0.08 0.11 0.0

PTM-CHA - Simulation

/*does a point to x*/ for(i=0;i<N-1;i++) if(!RANDOM(10000)) /*0.01% taken*/ { swap(); b = a; } a[i] = x[i+1]; /*assume lots of other work as well...*/ } return 0;}

Page 59: The PPA Algorithm

Future Work Currently in the early stages of implementing for SUIF. What happens when Double/Multiple pointers are

introduced? How to deal with casting, irregular control flow, pointer

arithmetic, unknown/library functions? When to propagate the unknown ‘UNK’ location set

Optimizing for time complexity and space. How to best utilize PPA for TLS and/or other compiler

optimizations? Runtime parameters. What is the relationship between data and control?

Page 60: The PPA Algorithm

The End… Any Comments or Questions?