[Paper Review] Ascertaining Uncertainty for Efficient Exact Cache Analysis

Valentin Touzeau, Claire Maïza+2 more|arXiv (Cornell University)|Sep 28, 2017

Real-Time Systems Scheduling16 references252 citations

TL;DR

The paper introduces a new abstract interpretation to prove definite uncertainty in cache analysis and uses model checking to achieve exact, path-sensitive classification of cache hits and misses on a per-instruction basis.

ABSTRACT

Static cache analysis characterizes a program's cache behavior by determining in a sound but approximate manner which memory accesses result in cache hits and which result in cache misses. Such information is valuable in optimizing compilers, worst-case execution time analysis, and side-channel attack quantification and mitigation.Cache analysis is usually performed as a combination of `must' and `may' abstract interpretations, classifying instructions as either `always hit', `always miss', or `unknown'. Instructions classified as `unknown' might result in a hit or a miss depending on program inputs or the initial cache state. It is equally possible that they do in fact always hit or always miss, but the cache analysis is too coarse to see it.Our approach to eliminate this uncertainty consists in (i) a novel abstract interpretation able to ascertain that a particular instruction may definitely cause a hit and a miss on different paths, and (ii) an exact analysis, removing all remaining uncertainty, based on model checking, using abstract-interpretation results to prune down the model for scalability.We evaluated our approach on a variety of examples; it notably improves precision upon classical abstract interpretation at reasonable cost.

Motivation & Objective

• Improve precision of static cache analysis beyond traditional may/must analyses by reducing unknown classifications.
• Provide a safe, reusable method to determine when an access may definitely hit or miss across executions.
• Combine abstract interpretation with model checking to obtain exact classifications while maintaining scalability.

Proposed method

• Develop a novel abstract interpretation that derives existential properties (exists hit, exists miss, exists hit ∧ exists miss) to reduce uncertainty.
• Extend the abstract domain to EH (exists hit) and EM (exists miss) analyses that pair with a must/may framework.
• Use a focused cache model and a focused collecting semantics to enable exact, model-checked classification for remaining unknown accesses.
• Encode the remaining classification problem as finite-state model checking with a reduced program and cache model focused on the block of interest.
• Iteratively classify accesses: if AI yields definite results, skip model checking; otherwise, apply model checking to obtain exact classification.

Experimental results

Research questions

• RQ1 Can existing may/must cache analyses be augmented with an existential analysis to safely identify accesses that may hit or miss on some executions?
• RQ2 Does a focused, exact abstraction of the cache replacement policy combined with model checking yield complete and precise classification for remaining uncertain accesses?
• RQ3 Can abstraction-driven model checking be efficiently scaled by pruning the model using results from abstract interpretation?
• RQ4 What are the benefits of deflating the state space to a block-focused cache model for the precision and performance of the analysis?

Key findings

• The approach yields a larger portion of accesses classified as always hit, always miss, or definitely unknown compared to classical AI alone.
• The EH/EM analyses provide safe bounds on minimal and maximal ages, enabling definitive conclusions about some hits or misses on some executions.
• Model checking, guided by AI results, completes the remaining classification with exact results (always hit, always miss, or definitely unknown).
• A focused cache model preserves precision while greatly reducing model complexity, enabling scalable analysis for realistic benchmarks.
• Experimental evaluation on industrial-like settings shows precision gains and reduced model-checking effort due to effective pruning by the abstract phase.