Proving Optimizations Correct

Proving Optimizations Correct Proving Optimizations Correct - Start

Added : 2018-09-21 Views :3K

Download Presentation

Proving Optimizations Correct




Download Presentation - The PPT/PDF document "Proving Optimizations Correct" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.



Presentations text content in Proving Optimizations Correct

Slide1

Proving Optimizations Correctusing Parameterized Program Equivalence

University of California, San Diego

Sudipta KunduZachary TatlockSorin Lerner

Slide2

Compiler CorrectnessDifficult to develop reliable compilers:

large, complex programstake a long time to matureConsequence: buggy compilers, but also …hinders development of new languages, architectures

discourages user from extending compilerFocus on correctness of compiler optimizationsmany intricate opts, unexpected interactionsturning off optimizations often no longer an option

Slide3

Existing TechniquesTranslation Validation

prove equivalencefor each transformationevery compiler execution

a priori

C

orrectness

prove correctness

before compiler runs

once and for all

TVOC

[

Zuck

et al.]

Rhodium

[Lerner et al.]

Compcert

[Leroy et al.]

[

Necula

00]

Focus on Automated Techniques

Verified TV

[Tristan et al.]

[

Pnueli

et al.]

Slide4

Scope of Guarantee

Verify Compiler Run

Verify Compiler

TVOC

[

Zuck

et al.]

Rhodium

[Lerner et al.]

[

Necula

00]

Expressive Power

Complex

Loop OptsOne-to-one Rewrites

Focus on Automated Techniques

complex loop opts

+

once-and-for-all

correctness

Our Approach:

Adapt Translation Validation to once-and-for-all setting

Key Insight:

Slide5

Generalize to Parameterized Progs

Equivalence

Checking

Generalize to Parameterized Programs

Output

Prog

Input

Prog

Output

PProg

Input

PProg

Translation Validation

k := 0

while(

k<

100){

a[k] += k

k++

}

Slide6

Generalize to Parameterized Progs

Equivalence

Checking

Generalize to Parameterized Programs

I := 0

while(

I<

100){

a[k] += I

I++

}

Output

Prog

Input

Prog

Output

PProg

Input

PProg

Slide7

Generalize to Parameterized Progs

Equivalence

Checking

Generalize to Parameterized Programs

I := 0

while(

I<

E){

a[k] += I

I++

}

Output

Prog

Input

Prog

Output

PProg

Input

PProg

Slide8

Equivalence

Checking

I := 0

while(

I<

E){

S

I++

}

I := 0

while(

I<

E){

S

I++

}

Generalize to Parameterized

Progs

Output

Prog

Input

Prog

Generalize to Parameterized Programs

Output

PProg

Input

PProg

Optimization

Instance

Optimization

Slide9

Generalize to Parameterized

Progs

Equivalence

Checking

Generalize to Parameterized Programs

Parameterized

Equivalence

Checking

Optimization

Instance

Optimization

Output

Prog

Input

Prog

Output

PProg

Input

PProg

Slide10

Contributions

Parameterized

Equivalence

Checking

Parameterized Equivalence Checking (PEC)

proves opts correct statically and automatically

can reason about many-to-many opts

Expressed and proved a variety of opts correct

which Rhodium could not have proven correct

software pipelining and other complex loop opts

1

2

3

Optimization

Output

PProg

Input

PProg

Slide11

I

:= 0

while(I<E-1){ S

I

++

}

SI++Parameterized Rewrite RulesLoop Peelingmove iter out of loopids range over:

I : variable

E

: expressionS

: statementShift final iteration after loopSide conditions indicate when rewrite safe

I

:= 0

while(I < E){

S

I

++

}

where:

E > 0

S

does not modify

I, E

Slide12

Enable loop unrolling

Apply RewriteMatch parameters

Check side condsRewrite

where:

100 > 0

a[k] += k

does not modify k,100Applying Rewrite Rules

I := 0

while(I < E){

S

I

++

}

I

:= 0

while(I<

E-1){ S

I

++}

SI++where:

E > 0

S does not modify I,

E

k := 0

while(

k<

100){

a[k] += k

k++

}

k := 0

while(

k<

99){

a[k] += k

k++

}

a[k] += k

k++

Divisible by 3

Directly unroll by 3

Not divisible by 3

Hard to unroll by 3

Slide13

Checking Correctness

OPT

Parameterized

Equivalence

Checking

Slide14

OPT

Checking Correctness

Generalization of

[

Necula

00 ]

Generalization of

[

Zuck

et al. 04]

OR

Relate

Permute

Relate

Slide15

I

:= 0

while(

I<

E-1){

S

I++}

SI++

I

:= 0

while(I < E){

S

I

++

}where:

E

> 0

S does not modify

I, E

Checking Rewrite Rules

I:=0

I<E

I≥E

S

I++

I:=0

I<E-1

I≥E-1

S

I++

S

I++

σ

1

=

σ

2

Programs equivalent:

Consider CFGs

Start

in equal states

End in equal states

σ

1

=

σ

2

Slide16

Checking Rewrite Rules

Relate Executions:

Find

synchronization

points

Generate

invariants

Check invariants

preserved

I:=0

I<E

I≥E

S

I++

I:=0

I<E-1

I≥E-1

S

I++

S

I++

A

B

Use auto theorem

prover

Each invariant must imply successor invariants

Strengthen if inv too weak

σ

1

=

σ

2

σ

1

=

σ

2

Slide17

1. Find Synchronization Points

I<E

S

I++

I:=0

I<E-1

I≥E-1

S

I++

S

I++

Traverse in lockstep

Stop

at stmt

params

Prune infeasible paths

From Path:

E≤0

Side

Conds

:

E>0

Path never executes

I:=0

I≥E

Slide18

2. Generate Invariants

I:=0

I<E

I≥E

S

I++

I:=0

I<E-1

I≥E-1

S

I++

S

I++

Invariants:

predicates over

σ

1

,

σ

2

Gen initial invariant:

σ

1

=

σ

2

AND

strongest post

cond

σ

1

=

σ

2

σ

1

=

σ

2

B

A

A

(

σ

1

,

σ

2

)

...

B

(

σ

1

,

σ

2

)

...

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

...

B

A

I<E

I<E-1

I≥E-1

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

Slide19

3. Check Invariants

I:=0

I<E

I≥E

S

I++

I:=0

I<E-1

I≥E-1

S

I++

S

I++

σ

1

=

σ

2

σ

1

=

σ

2

B

A

Each invariant must imply successor invariants

Query Theorem

Prover

B

A

I<E

S

I++

I≥E-1

S

I++

S

I++

I<E

S

I++

I≥

E-1

A

B

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

Entry

 A

Entry

 B

A

 B

A

 A

B

 Exit

Slide20

σ

1 σ2 .

A

(

σ

1

,

σ2) ∧σ1’ = step(σ1, S;I++;

I<E)

∧σ

2’ = step(σ

2

, S;I++;I≥E-1)

B

(

σ1’,

σ2

’)

3. Check Invariants

A

B

S

I++

I<E

S

I++

I≥

E-1

σ

1

σ

2

σ

1

σ

2

σ

1

σ

2

.

A

(

σ

1

,

σ

2

)

σ

1

’ = step(

σ

1

, S;I++;

I<

E)

σ

2

’ = step(

σ

2

, S;I++;

I≥

E-1)

B

(

σ

1

’,

σ

2

’)

ATP Query:

ATP

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

Slide21

σ

1

σ

2

.

A

(

σ

1

,

σ

2

)

σ1

’ = step(σ1

, S;I++;I<E)

σ2’ = step(

σ2, S;I++;I≥E-1)

B

(σ1

’, σ

2

’)3. Check Invariants

A

B

S

I++

I<E

S

I++

I≥

E-1

σ

1

σ

2

σ

1

σ

2

ATP Query:

ATP

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

Slide22

σ

1

σ

2

.

A

(

σ1,

σ

2) ∧

σ1’ = step(

σ

1, S;I++;I<

E)

σ2

’ = step(σ2

, S;I++;

I≥E-1)

B(

σ1’, σ2’)

3. Check Invariants

B

S

I++

I<E

S

I++

I≥

E-1

σ

1

σ

2

σ

1

σ

2

ATP Query:

ATP

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

A

B

(

σ

1

’,

σ

2

’)

Strengthen A if the theorem

prover

fails

σ

1

’ = step(

σ

1

, S;I++;

I<

E)

σ

2

’ = step(

σ

2

, S;I++;

I≥

E-1)

A

Slide23

3. Check Invariants

I:=0

I<E

I≥E

S

I++

I:=0

I<E-1

I≥E-1

S

I++

S

I++

σ

1

=

σ

2

σ

1

=

σ

2

B

A

A

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I < E-1)

B

(

σ

1

,

σ

2

)

σ

1

=

σ

2

eval

(

σ

1

, I < E)

eval

(

σ

2

, I ≥ E-1)

Each invariant must imply successor invariants

Query Auto Theorem

Prover

Entry

 A

Entry

 B

A

 B

A

 A

B

 Exit

Slide24

OPT

Checking Correctness

Generalization of

[

Necula

00 ]

Generalization of

[

Zuck

et al. 04]

OR

Relate

Permute

Relate

Permute

Works well for structure-preserving optimizations

Works well for non structure-preserving optimizations

Slide25

Permute Module

for (I in R1){

for (J in R2){ S[I, J]; }}

for (N in R2){

for (M in R1){

S[M, N];

}

}

where: ⟨side condition⟩

Generate correspondence between loop indices

Ask ATP to show that

side condition⟩ implies:correspondence is one-to-one

For all I, I’

∊ R1 and J, J’

∊ R2 S[I, J] commutes with S[I’, J’]

Loop Interchange

Slide26

Contributions

Parameterized

Equivalence

Checking

Parameterized Equivalence Checking (PEC)

proves opts correct statically and automatically

can reason about many-to-many opts

Expressed and proved a variety of opts correct

which Rhodium could not have proven correct

software pipelining and other complex loop opts

1

2

3

Optimization

Output

PProg

Input

PProg

Slide27

Optimizations Proved Correct

Category 1: PEC and Rhodium formulation equivalent

Copy propagationConstant propagationCommon sub-expression elimPartial redundancy elimCategory

2:

PEC formulation easier, more general

Loop invariant code hoisting

Conditional speculation

Speculation

Category 3:Expressible in PECNo Rhodium formulation possibleSoftware pipelining Loop unswitching Loop unrolling Loop peelingLoop splitting Loop alignment Loop interchange Loop reversal Loop skewing Loop fusion

Loop distribution

Slide28

Conclusion

Parameterized

Equivalence

Checking

Parameterized Equivalence Checking (PEC)

proves opts correct statically and automatically

can reason about many-to-many opts

Expressed and proved a variety of opts correct

which Rhodium could not have proven correct

software pipelining and other complex loop opts

Optimization

Output

PProg

Input

PProg

Slide29


About DocSlides
DocSlides allows users to easily upload and share presentations, PDF documents, and images.Share your documents with the world , watch,share and upload any time you want. How can you benefit from using DocSlides? DocSlides consists documents from individuals and organizations on topics ranging from technology and business to travel, health, and education. Find and search for what interests you, and learn from people and more. You can also download DocSlides to read or reference later.
Youtube