1. S CALABLE A ND P RECISE R EFINEMENT OF C ACHE T IMING A NALYSIS VIA M ODEL C HECKING Sudipta Chattopadhyay Abhik Roychoudhury 1

2. T IMING ANALYSIS Hard real time systems require absolute timing guarantees System level analysis Single task analysis Worst case execution time (WCET) analysis An upper bound on execution time for all possible inputs Sound over-approximation is obtained by static analysis 2

3. Program Cache analysis Pipeline analysis Branch predictor modeling WCET of basic blocks constraints Infeasible path constraints Loop bound Micro architectural modeling Path analysis 3 WCET ANALYSIS IPET = Implicit Path Enumeration Technique IPET

4. I MPRECISION IN A BSTRACT I NTERPRETATION p1 p2 Cache state = C1 Cache state = C2 Joined Cache state = C3 4 a b b x Abstract LRU cache set Abstract LRU cache set young b Joined cache state Path p1 or path p2? Joined cache state loses information about path p1 and p2 LRU=Least recently used

5. M ODEL C HECKING ALONE ? A path sensitive search Path sensitive search is expensive – path explosion Worse, combined with possible cache states p1 p2 Cache state = C1 Cache state = C2 5

6. M ODEL C HECKING ALONE ? A path sensitive search Path sensitive search is expensive – path explosion Worse, combined with possible cache states p1 p2 6 a b young b x Abstract LRU cache set young a b Abstract LRU cache set young b x Abstract LRU cache set young State Explosion

7. C OMPARISON 7 ILP: Integer Linear Programming, AI: Abstract interpretation MC: Model Checking WorkMicro-arch. level technique Program level technique PrecisionScalability Classical AIAI × √ Classical MCMC √ × RTS’00 (aiT, Chronos) AIILP Can be improved √ RTSS’10AIMC Can be improved _ Our approach(AI+MC)ILP > RTS’00= RTS’00

8. C ACHE ANALYSIS Program Pipeline analysis Branch predictor modeling WCET of basic blocks constraints Infeasible path constraints Loop bound IPET Micro architectural modeling Path analysis Cache analysis by abstract interpretatio n Analysis outcome Refine by model checker All checked Timeout 8 Refinement by model checker can be terminated at any point Model checker refinement steps are inherently parallel Each model checker refinement step checks light assertion property

9. M ODEL CHECKER REFINEMENT Three different architectural/application settings Model checker refinements eliminate spurious cache conflicts in all three settings Intra task (WCET in single core) High priority Low priority Inter task (Cache Related Preemption Delay analysis) cache L1 cache Shared L2 cache Task in Core 1 Task in Core 2 Inter core (WCET in multi-core) 9

10. A N E XAMPLE 10 Path 1 Path 2 Cache hit Cache miss m mm mm Two consecutive accesses of a memory block m Join Abstract interpretation cannot decide cache hit or miss Conflict to m m’x < y x == y m’ m An infeasible path Infeasible cache conflict Spurious

11. R EFINEMENT (I NTRA - TASK ) 11 Path 1 Path 2 Cache hit Cache miss m mm Conflict to m m’ C_m++ Increment conflict assert (C_m <= 0) Property ( direct mapped cache) x < y x == y m’ m Verified Infeasible cache conflict mm <=0 cache conflicts cache hit Cache hit

12. R EFINEMENT (I NTRA - TASK ) 12 Path 1 Cache hit Cache miss m mm m1m1 C_m++ Increment conflict assert (C_m <= N-1) Property ( N-way associative cache) Verified Conflict to m m2m2 C_m++ Increment conflict Conflict to m mNmN C_m++ Increment conflict Conflict to m x < y x == y mimi mjmj Infeasible cache conflict mNmN m1m1 mm <=N-1 cache conflicts cache hit Cache hit

13. R EFINEMENT (I NTRA - TASK ) 13 Path 2 Cache miss m m Conflict to m m’ C_m++ Increment conflict assert (C_m <= 0) Property ( direct mapped cache ) Does not affect the value of C_m x < y x == y m’ m

14. R EFINEMENT (I NTER - TASK AND I NTER - CORE ) 14 High priority Low priority cache L1 cache Shared L2 cache Task in Core 1 Task in Core 2

15. R EFINEMENT (I NTER - TASK AND I NTER - CORE ) 15 m m Task Cache hit start exit Conflictin g task Cache miss m1m1 m2m2 m cache x < y x == y Infeasible m1m1 m2m2 Spurious ≠m young

16. R EFINEMENT (I NTER - TASK AND I NTER - CORE ) m m Task start exit Conflictin g task m1m1 m2m2 m cache x < y x == y Infeasible m1m1 m2m2 C_m++ Increment conflict C_m++ Increment conflict assert (C_m <= 1) Verified m A Cache Hit 16 young

17. R EDUCING NUMBER OF M ODEL C HECKING CALLS Model checker results can be reused assert(C <= N) is satisfied assert(C <= N+1), …., assert(C <= ∞) is also satisfied assert(C <= N) is violated assert(C <= N-1), …., assert(C <= 1) is also violated 17

18. E XPERIMENTAL S ETUP (C HRONOS T OOLKIT ) 18 C source GCC simplescalar Binary codeCFG Micro architectural modeling cachepipelineBranch prediction Micro-architectural constraints ILP Flow constraints WCET CBMC

19. E XPERIMENTAL R ESULT All possible refinements made Terminate? Model checker is not called 19

20. E XPERIMENTAL R ESULT 20 Intra task (single core WCET) cache4-way associative, 8 KB Time = 500 seconds

21. E XPERIMENTAL R ESULT 21 High priority Low priority cache Cache Related Preemption Delay 4-way associative, 8 KB Average time = 250 secs Low priority tasks cnt jfdctint edn fir fdct ndes

22. E XPERIMENTAL R ESULT 22 L1 cache Shared L2 cache WCET 4-way associative, 8 KB Direct-mapped, 256 bytes Average time = 70 secs Tasks cnt jfdctint edn fir fdct ndes

23. S UMMARY A general framework combining abstract interpretation and model checking for cache timing analysis Salient features Easy integration with other micro-architectural modeling Inherent parallelism Model checker task checks light assertion properties (reduces the time for one call) “Anytime” algorithm Flexibility Code transformation can easily be fine tuned to target different cache replacement policies (e.g. FIFO) 23

24. P ATH A NALYSIS BY M ODEL C HECKING T NT T x == y x < y t += c1 t += c2 t += c3 t += c4 t += c5 t += c6 Unroll Explore the states c1+c2+c3+ c4+c6+c1 c1+c2+c3+c4 c1 c1+c2c1+c4 c1+c2+c3 c1+c2+c4 assert (t <= make a guess) T c1+c2+c3+ c4+c6 24

25. 25 Questions Thank You

26. S TATE E XPLOSION IN MC BASED CACHE ANALYSIS Why AI + ILP Is Good for WCET, but MC Is Not, Nor ILP Alone VMCAI, 2004 METAMOC: Modular execution time analysis using model checking WCET workshop, 2010 L1 cache analysis for single task. Generates state space explosion for simple programs. 26