Synthesizing Loops For Program Inversion

Transcription

1 For RC 212 Synthesizing Loops For Program Inversion Cong Hou, Daniel Quinlan, David Jefferson, Richard Fujimoto, Richard Vuduc

2 Program Inversion Given a program P, and its inverse P -, then we have P ; P - = no-op Examples: ++a/--a, swap(a,b)/swap(a,b), compression/ decompression, encryption/decryption, etc.. Assume the input and output of P are IN and OUT: P IN P - OUT Reverse program 2

3 Program Inversion What if P is not reversible? IN: a a = ; OUT: a P 3

4 Program Inversion What if P is not reversible? IN: a a = ; OUT: a Make it reversible! P IN: a s = a; a = ; IN: a, s a = s; OUT: a, s OUT: a P + P - 3

5 Program Inversion What if P is not reversible? IN: a a = ; OUT: a Make it reversible! P State Saving IN: a s = a; a = ; IN: a, s a = s; OUT: a, s OUT: a P + P - 3

6 Program Inversion What if P is not reversible? IN: a a = ; OUT: a Make it reversible! P State Saving Forward program IN: a IN: a, s P + s = a; a = ; OUT: a, s a = s; OUT: a P + P - IN P - OUT+S Reverse program 3

7 Our Previous Work We have built a framework that can generate the forward and reverse programs for loop-free programs. We have implemented this framework into a compiler called Backstroke. For more details please refer to our CC paper: C. Hou, G. Vulov, D. Quinlan, D. Jefferson, R. Fujimoto, and R. Vuduc. A new method for program inversion. International Conference on Compiler Construction,

8 Overview Of Our Previous Work Our approach: Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions 5

9 Overview Of Our Previous Work Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions We turn the program into the SSA (Static Single Assignment) form CFG (Control Flow ), so that each variable is defined only once and can represent a distinct value. An SSA graph is then built to show the data dependencies between different values. 6

10 Overview Of Our Previous Work Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions We build a Value Search (VSG) showing all equality relations between values in the program. Finding the inverse becomes a search problem in this graph. Each equality is constrained by a condition represented by a set of CFG paths. 7

11 Overview Of Our Previous Work Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions We then search for the desired values by following the equalities until available values are reached. The search should guarantee that each value is retrieved for all CFG paths. The search result which we call a Route (RG) shows valid data dependences in reverse program. 8

12 Overview Of Our Previous Work Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions The forward and reverse programs are built based on the search result. 9

13 Example: Building SSA Form CFG Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions IN: a, b void foo() { if (a == ) a = 1; else { b = a + 1; a = ; OUT: a, b Entry if (a == ) T F b 1 = a + 1; a 1 = 1; a 2 = ; a 3 = Φ(a 1, a 2 ); b 2 = Φ(b, b 1 ); Exit SSA form CFG 1

14 Example: Building SSA Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions Entry if (a == ) Φ T a 1 = 1; F b 1 = a + 1; a 2 = ; 1 a 1 a 3 a 2 Φ b 2 a 3 = Φ(a 1, a 2 ); == + b 2 = Φ(b, b 1 ); b 1 b Exit a 1 SSA form CFG SSA 11

15 Example: Building Value Search Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions Φ a 3 {T,F b {T 1 Φ Φ SS Φ a 1 a 2 b 2 a 3 {F {F b 2 == + b 1 b 1 a 1 a 2 {T,F - b 1 {F + 1 {F a Target nodes {T a 1 SSA Available nodes Value Search 12

16 Example: Building Value Search Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions Φ a 3 State saving edges {T,F b {T 1 Φ Φ SS Φ a 1 a 2 b 2 a 3 {F {F b 2 == + b 1 b 1 a 1 a 2 {T,F - b 1 {F + 1 {F a Target nodes {T a 1 SSA Available nodes Value Search 12

17 Example: Building Value Search Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions Φ a 3 State saving edges {T,F b {T 1 Φ Φ SS Φ a 1 a 2 b 2 a 3 {F {F b 2 == + b 1 b 1 a 1 a 2 {T,F - b 1 {F + 1 {F a Target nodes {T a 1 SSA Available nodes Value Search 12

18 Example: Building Route Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions F {T,F b T {T {F b {T Φ SS Φ SS Φ a 3 {F F {F b 2 {F b 2 1 a 1 a 2 {T,F - b 1 {F + - b 1 F {F {F T {T a 1 {T a 1 Route 13

19 Example: Generating The Forward Program Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions {T SS a {F {T b {F b 1 - {F Route Φ b 2 1 void foo_forward() { int trace = ; if (a == ) { trace = 1; a = 1; else { store(b); b = a + 1; a = ; store(trace); Red: Path recording. Blue: State saving. 14

20 Example: Generating The Reverse Program Original Function SSA form CFG SSA Value Search Route Forward and Reverse Functions {T SS a {F - {F b b 1 {T {F Φ b 2 1 void foo_reverse() { int trace; restore(trace); if ((trace & 1) == 1) a = ; else { a = b - 1; restore(b); Route 15

21 Example: Generated Forward And Reverse Programs void foo() { if (a == ) a = 1; else { b = a + 1; a = ; void foo_forward() { int trace = ; if (a == ) { trace = 1; a = 1; else { store(b); b = a + 1; a = ; store(trace); Red: Path recording. Blue: State saving. 16 void foo_reverse() { int trace; restore(trace); if ((trace & 1) == 1) a = ; else { a = b - 1; restore(b);

22 Handling Loops What problems do loops bring? Cyclic control flow paths. Solution: In the CFG, we collapse the loop into a single node and remove cycles. Also, we record the control flows in the loop body separately, where the loop body is treated as another loop-free program. 17

23 Handling Loops Recording CFG paths for Programs with Loops Entry Entry Exit Exit 18

24 Handling Loops What problems do loops bring? Cyclic control flow paths. Solution: In the CFG, we collapse the loop into a single node and remove cycles. Also, we record the control flows in the loop body separately, where the loop body is treated as another loop-free program. If we want to build loops in the reverse program, cycles may be formed in the Route. Solution: we build special constructs in VSG for loops and also develop special searching rules. 19

25 Handling While Loops While loop: a special single-entry single-exit loop. A F For each variable modified in a while loop, we define four special definitions of it. v in B T v in : The input of the loop. v out : The output of the loop. v I in = μ(v in, vi out ); while(...) T v I out =...; v I in : The input of the iteration. v I out : The output of the iteration. F v out = η(v I in ); 2

26 Handling While Loops Those four definitions in the VSG: Forward edges represent data flows in the original (forward) programs. Reverse edges represent data flows in the reverse programs. μ v I in η v in μ' v out v I out forward edge reverse edge 21

27 Handling While Loops Those four definitions in the VSG: Forward edges represent data flows in the original (forward) programs. Reverse edges represent data flows in the reverse programs. Initialization on the first iteration μ v I in η v in μ' v out v I out forward edge reverse edge 21

28 Handling While Loops Those four definitions in the VSG: Forward edges represent data flows in the original (forward) programs. Reverse edges represent data flows in the reverse programs. Initialization on the first iteration μ v I in η After each iteration, the output becomes the input v in μ' v I out v out forward edge reverse edge 21

29 Handling While Loops Those four definitions in the VSG: Forward edges represent data flows in the original (forward) programs. Reverse edges represent data flows in the reverse programs. Initialization on the first iteration After each iteration, the output becomes the input v in μ μ' v I out v I in η v out forward edge reverse edge The output value of the loop is the last definition of the mu node. 21

30 Handling While Loops Special search rules on the VSG: Allows cycles to be formed. But each cycle must contain a forward/reverse edge between the input and output of the iteration. μ v I in η v in μ' v out v I out During the search for a given value, the forward and reverse edges cannot coexist in the search result. 22

31 Handling While Loops Building the loop body. Using the same method we build the reverse code for loop-free programs. Building the loop predicate. Approach 1: Building the same loop predicate as in the original loop. Approach 2: If there is a monotonic variable in a loop, build the loop predicate from it. Approach 3: Insert a counter counting the number of iterations of the loop in the forward program, and use this counter to build the loop predicate in the reverse program. 23

32 Handling While Loops Building the loop predicate. Approach 1: Building the same loop predicate as in the original loop. i = ; while (A[i] > ) { /*... */ i = i + 2; Original loop i = ; while (A[i] > ) { /* generated loop body */ i = i + 2; Generated loop 24

33 Handling While Loops Building the loop predicate. Approach 2: If there is a monotonic variable in a loop, build the loop predicate from it. i = ; while (A[i] > ) { /*... */ i = i + 2; /* i == i1 */ Original loop i = ; while (i!= i1) { /* generated loop body */ i = i + 2; Generated loop 25

34 Handling While Loops Building the loop predicate. Approach 3: Insert a counter counting the number of iterations of the loop in the forward program, and use this counter to build the loop predicate in the reverse program. i = ; count = ; while (A[i] > ) { /*... */ i = i + 2; count = count + 1; store(count); Original loop restore(count); while (count > ) { /* generated loop body */ count = count - 1; Generated loop 26

35 An Example Our example: Given an integer n (n > ), get n. // input: n (n > ) s = ; while (n > ) { s = s + n; n = n - 1; // output: s s = ; s 1 = μ(s, s 2 ); n 1 = μ(n, n 2 ); while(n 1 > ) F s 3 = η(s 1 ); n 3 = η(n 1 ); T s 2 = s 1 + n 1 ; n 2 = n 1-1; The loop example CFG in SSA form 27

36 An Example The search result of our example. μ' μ' μ' n 2 n η n 3 n n 2 η n 3 n n 2 η n 3 μ μ μ n 1 n 1 n 1 μ μ μ s 1 s 1 s 1 η η η s s 3 s s 3 s s 3 μ' s 2 μ' s 2 μ' s 2 Available node Target node Forward edge Reverse edge 28

37 An Example The original and generated loop: s = ; while (n > ) { s = s + n; n = n - 1; n = ; while (s!= ) { n = n + 1; s = s - n; The original loop The generated loop 29

38 Handling Other Loops We only consider natural loops (loops with single-entry). A non-while loops may be: A loop with several exits. The entry and exit are at different nodes. 1 F T 2 1 F 2 T 1' 2' ' 4' 5'

39 Current And Future Work We are working on reversing programs with arrays. Specifically, we are interested in automatically reverse some injective programs like compression/decompression programs. We will research on how to rebuild the control flows in the reverse program without path recording. Questions? 31