CS 243 Lecture 11 Binary Decision Diagrams (BDDs) in Pointer Analysis

Transcription

1 CS 243 Lecture 11 Binary Decision Diagrams (BDDs) in Pointer Analysis 1. Relations in BDDs 2. Datalog -> Relational Algebra 3. Relational Algebra -> BDDs 4. Context-Sensitive Pointer Analysis 5. Performance of BDD Algorithms 6. Experimental Results Readings: Chapter 12 M. Lam & J. Whaley

2 Automatic Analysis Generation Programmer: Security analysis in 10 lines PQL Compiler writer: Ptr analysis in 10 lines 1000s of lines 1 year tuning Datalog BDD operations BDD: 10,000s-lines library bddbddb (BDD-based deductive database) with Active Machine Learning

3 1. Relations à BDDs Example B A D C calls(a,b) calls(a,c) calls(a,d) calls(b,d) calls(c,d)

4 Call Graph Relation x 1 x 2 x 3 x 4 f Relation expressed as a binary function. A=00, B=01, C=10, D=11 01 B D A C 10

5 Binary Decision Diagrams (Bryant, 1986) Graphical encoding of a truth table. x 1 0 edge 1 edge x 2 x 2 x 3 x 3 x 3 x 3 x 4 x 4 x 4 x 4 x 4 x 4 x 4 x

6 Binary Decision Diagrams Collapse redundant nodes. x 1 x 2 x 2 x 3 x 3 x 3 x 3 x 4 x 4 x 4 x 4 x 4 x 4 x 4 x

7 Binary Decision Diagrams Collapse redundant nodes. x 1 x 2 x 2 x 3 x 3 x 3 x 3 x 4 x 4 x 4 x 4 x 4 x 4 x 4 x 4 0 1

8 Binary Decision Diagrams Collapse redundant nodes. x 1 x 2 x 2 x 3 x 3 x 3 x 3 x 4 x 4 x 4 0 1

9 Binary Decision Diagrams Collapse redundant nodes. x 1 x 2 x 2 x 3 x 3 x 3 x 4 x 4 x 4 0 1

10 Binary Decision Diagrams Eliminate unnecessary nodes. x 1 x 2 x 2 x 3 x 3 x 3 x 4 x 4 x 4 0 1

11 Binary Decision Diagrams Eliminate unnecessary nodes. x 1 x 2 x 2 x 3 x 3 x 4 0 1

12 2. Datalog to Relational Algebra Union - Diff ρ old new Rename old with name Projection away column c π c Join two relations based on common column name EXAMPLE vp(variable, obj) Assign(dest, source) vp(v 1, o) :- assign(v 1, v 2 ),vp(v 2, o). t 1 = ρ variable source (vp); t 2 = assign t 1 ; t 3 = π source (t 2 ); t 4 = ρ dest variable (t 3 ); vp = vp t 4 ;

13 Semi-Naïve Evaluation Relations keep growing with each iteration The same computation is repeated with increasingly large tables lot of redundant work Example C(x,z) :- A(x,y), B(y,z) Let A i, B i, C i be the value in iteration i; be the diff with previous iteration. C i (x,z) :- C i-1 (x,z) C i (x,z) :- A i-1 (x,y), B i-1 (y,z) C i (x,z) :- A i-1 (x,y), B i-1 (y,z)

14 Example vp, assign: current values vp, assign : old values vp, assign : delta values t 1 = ρ variable source (vp); t 2 = assign t 1 ; t 3 = π source (t 2 ); t 4 = ρ dest variable (t 3 ); vp = vp t 4 ; vp = vp vp ; vp = vp; assign = assign assign ; assign = assign; t 1 = ρ variable source (vp ); t 2 = assign t 1 ; t 5 = ρ variable source (vp); t 6 = assign t 5 ; t 7 = t 2 t 6 ; t 3 = π source (t 7 ); t 4 = ρ dest variable (t 3 ); vp = vp t 4 ;

15 Eliminate Loop Invariant vp = vp vp ; vp = vp; assign = assign assign ; assign = assign; t 1 = ρ variable source (vp ); t 2 = assign t 1 ; t 5 = ρ variable source (vp); t 6 = assign t 5 ; t 7 = t 2 t 6 ; t 3 = π source (t 7 ); t 4 = ρ dest variable (t 3 ); vp = vp t 4 ; Computations vp = vp vp ; vp = vp; t 1 = ρ variable source (vp ); t 2 = assign t 1 ; t 3 = π source (t 2 ); t 4 = ρ dest variable (t 3 ); vp = vp t 4 ; NOTE: assign never changes

16 3. Datalog à BDDs Datalog Relations Relation algebra:,, select, project Relation at a time Semi-naïve evaluation Fixed-point BDDs Boolean functions Boolean function ops:,,, Function at a time Incrementalization Iterate until stable

17 BDD: Relational Product (relprod) Relprod is a Quantified Boolean Formula h = x 1,x 2,.. f(x 1,x 2, ) g(x 1,x 2, ) h(v 1, v n ) is true if x 1,x 2,.. f(x 1,x 2,,, v i, ) g(x 1,x 2,,, v j, ) Same as an operation followed by projecting away common attributes Important because it is common and much faster to combine the operations in BDDs

18 Relational algebra -> BDD operations vp = vp vp ; vp = vp; t 1 = ρ variable source (vp ); t 2 = assign t 1 ; t 3 = π source (t 2 ); t 4 = ρ dest variable (t 3 ); vp = vp t 4 ; relprod: relational product vp = diff(vp, vp ); vp = copy(vp); t 1 = replace(vp,variable source); t 3 = relprod(t 1,assign,source); t 4 = replace(t 3,dest variable); vp = or(vp, t 4 ); NOTE: assign never changes

19 4. Context-Sensitive Pointer Analysis Algorithm 1. First, do context-insensitive pointer analysis to get call graph. 2. Number clones. 3. Do context-insensitive algorithm on the cloned graph. Results explicitly generated for every clone. Individual results retrievable with Datalog query.

20 Size of BDDs Represent tiny and huge relations compactly Size depends on redundancy Similar contexts have similar numberings Variable ordering in BDDs

21 BDD Variable Order is Important! x 1 x 2 + x 3 x 4 x 1 x 1 x 2 x 3 x 3 x 3 x 2 x 2 x 4 x x 1,x 2,x 3,x 4 x 1,x 3,x 2,x 4

22 Expanded Call Graph A A 0 B C D B 0 C 0 D 0 E E 0 E 1 E 2 F G F 0 F 1 F 2 G 0 G 1 G 2 H H 0 H 1 H 2 H 3 H 4 H 5

23 Numbering Clones 0 A B C D E F G A 0 B 0 C 0 D 0 E 0 E 1 E 2 F 0 F 1 F 2 G 0 G 1 G H H 0 H 1 H 2 H 3 H 4 H 5

24 5. Performance of Context-Sensitive Pointer Analysis Direct implementation Does not finish even for small programs > 3000 lines of code Requires tuning for about 1 year Easy to make mistakes Mistakes found months later

25 An Adventure in BDDs Context-sensitive numbering scheme Modify BDD library to add special operations. Can t even analyze small programs. Time: Improved variable ordering Group similar BDD variables together. Interleave equivalence relations. Move common subsets to edges of variable order. Time: 40h Incrementalize outermost loop Very tricky, many bugs. Time: 36h Factor away control flow, assignments Reduces number of variables Time: 32h

26 An Adventure in BDDs Exhaustive search for best BDD order Limit search space by not considering intradomain orderings. Time: 10h Eliminate expensive rename operations When rename changes relative order, result is not isomorphic. Time: 7h Improved BDD memory layout Preallocate to guarantee contiguous. Time: 6h BDD operation cache tuning Too small: redo work, too big: bad locality Parameter sweep to find best values. Time: 2h

27 An Adventure in BDDs Simplified treatment of exceptions Reduce number of vars, iterations necessary for convergence. Time: 1h Change iteration order Required redoing much of the code. Time: 48m Eliminate redundant operations Introduced subtle bugs. Time: 45m Specialized caches for different operations Different caches for and, or, etc. Time: 41m

28 An Adventure in BDDs Compacted BDD nodes 20 bytes à 16 bytes Time: 38m Improved BDD hashing function Simpler hash function. Total development time: 1 year 1 year per analysis?!? Optimizations obscured the algorithm. Many bugs discovered, maybe still more. Time: 37m Create bddbddb to make optimization available to all analysis writers using Datalog

29 Variable Numbering: Active Machine Learning Must be determined dynamically Limit trials with properties of relations Each trial may take a long time Active learning: select trials based on uncertainty Several hours Comparable to exhaustive for small apps

30 Summary: Optimizations in bddbddb Algorithmic Clever context numbering to exploit similarities Query optimizations Magic-set transformation Semi-naïve evaluation Reduce number of rename operations Compiler optimizations Redundancy elimination, liveness analysis, dead code elimination, constant propagation, definition-use chaining, global value numbering, copy propagation BDD optimizations Active machine learning BDD library extensions and tuning

31 6. Experimental Results Top 20 Java projects on SourceForge Real programs with 100K+ users each Using automatic bddbddb solver Each analysis only a few lines of code Easy to try new algorithms, new queries Test system: Pentium 4 2.2GHz, 1GB RAM RedHat Fedora Core 1, JDK 1.4.2_04, javabdd library, Joeq compiler 30

32 Analysis time Seconds y = x R 2 = Variable nodes (K) 31

33 Analysis memory 1000 y = x R 2 = Megabytes (K) Variable nodes 32

34 Benchmark Nine large, widely used applications Blogging/bulletin board applications Used at a variety of sites Open-source Java J2EE apps Available from SourceForge.net

35 Vulnerabilities Found SQL injection HTTP splitting Cross-site scripting Path traveral Total Header Parameter Cookie Non-Web Total

36 Benchmark Accuracy Classes Context insensitive Context sensitive False jboard blueblog webgoat blojsom personalblog snipsnap road2hibernate pebble roller Total

37 Automatic Analysis Generation Programmer: Security analysis in 10 lines PQL Compiler writer: Ptr analysis in 10 lines 1000s of lines 1 year tuning Datalog BDD operations BDD: 10,000s-lines library bddbddb (BDD-based deductive database) with Active Machine Learning

38 Software System is publicly available at: