Design and Analysis of Time-Critical Systems Cache Analysis and Predictability

Transcription

1 esign and nalysis of Time-ritical Systems ache nalysis and Predictability Jan saarland university ES Summer School 2017 Fiuggi, Italy computer science

2 n nalogy alvin and Hobbes by Bill Watterson November 26,

3 an We Predict Software Behavior? Security: l oes this app leak my private data? l re buffer overflow attacks possible? Verification: l an this program crash? l oes it behave according to specification? Timing nalysis: l What is the maximum runtime of this program? l Important Subproblems: Which address will be accessed? Will this memory access result in a cache hit? 3

4 Prediction is Impossible! lan Turing: The halting problem is undecidable. lan Turing Henry Gordon Rice: ny non-trivial property of programs is undecidable. 4

5 pproximative Solutions Program nalysis for Property X Yes on t know No 5

6 Underapproximation: Testing Test the program on a finite subset of its inputs: Undetected fault etected fault all behaviours of the program test cases Program testing can be used to show the presence of bugs, but never to show their absence! ijkstra (1970) 6

7 Sound Static Program nalysis (bstract Interpretation) Over-approximate all possible behaviors: ll violations detected Infeasible behaviours all behaviours of the program Warning: False positive 7

8 Static nalysis in a Nutshell Set of initial states + inputs oncrete Behaviors safe approximation bstract Behaviors 8

9 How to achieve safe approximation? 1. Every abstract state s # represents a set (s # ) of rete states: 9

10 How to achieve safe approximation? 2. Local onsistency: abstract successors over-approximate rete successors may represent more states à imprecision 10

11 How to achieve safe approximation? oncrete Behaviors safe approximation bstract Behaviors Local onsistency Local onsistency 11

12 pplication: Static ache nalysis ache: Small, but fast memory that buffers part of main memory hi! hei!? E? miss hit [EB] [B] [B] hei! E? PU ache Main Memory Goal of static cache analysis is to classify memory accesses as guaranteed cache hits 12

13 oncrete ache States: Least-Recently-Used Replacement Notion of ge B most-recently-used least-recently-used E B F most-recently-used least-recently-used 13

14 oncrete ache Behavior: Least-Recently-Used Replacement How do rete cache states change upon memory accesses? ccess to : hit ccess to E: miss B B E B 14

15 Brainstorming: Predicting ache Hits Want to soundly predict cache hits. How to compactly represent sets of rete states for this purpose? 15

16 bstract Must ache States ompactly represent sets of rete states: {B} {,} {} oncrete states in which: B s age is at most 1, s and s age is at most 2 and s age is at most 3. Upper bound on ages of memory blocks 16

17 bstract Must ache States ompactly represent sets of rete states: B {B} {,} B B {} B Upper bound on ages of memory blocks 17

18 bstract Must ache States ompactly represent sets of rete states:? 18

19 bstract Must ache Behavior How do abstract cache states change upon memory accesses? {B} {,} {} ccess to : definite hit {} {,B} {} ccess to E: potential miss {E} {} {,B} 19

20 bstract Must ache Behavior: Local onsistency ccess to : hit {} {B} {,} {,B} {} {} B B B B ccess to B B 20

21 Integration with Pipeline nalysis uring microarchitectural analysis, analysis states are pairs: (pipeline state, cache state) Upon uncertainty, e.g. whether a cache hit or miss happens, split. If two analysis states agree on the pipeline state, the cache states are joined. 21

22 Properties of the Join Soundness: Must not lose any rete states: () ( B) (B) ( B) Precision: Want the best representation that is sound, i.e. the one that represents the fewest rete states. 22

23 Join for bstract Must ache States {} {,F} {} {}? {E} = {} {} {,} {} F F E???... à Take the maximum of the age bounds! 23

24 Example nalysis: Loop entry [,,, ]?t[,? [{},, {},,] t =[,,,,, ] ] = [,,, ] [{},,, ]? B [{},?,, ] [{B},? {},, ] t [{}, {},, ] = [, {},, ] exit [{},?, {}, ] No hits can be predicted! Why? 24

25 ontext-sensitive nalysis: Virtual Loop Peeling (Unrolling) The problem: The first iteration of a loop will always result in cache misses Similarly for the first execution of a recursive function solution: istinguish the first iteration of a loop from others istinguish function calls by calling context 25

26 ontext-sensitive nalysis: Example entry [{},,, ] B exit [{}, {},, ] B [,,, ] [{},,, ] [, {},, ] [{},, {}, ] [{}, {},, ] ccesses to and are provably hits after the first iteration ccesses to B and can still not be classified, but they can miss at most once à Need Persistence nalysis [, {}, {}, ] Note: Loop is only peeled virtually, i.e. during analysis not in the binary! exit 26

27 Brainstorming: Predicting ache Misses Want to soundly predict cache misses. How to compactly represent sets of rete states for this purpose? 27

28 Predicting ache Misses: bstract May ache States {} {B, } {, E, F} oncrete states in which: s age is at least 0, B s and s age is at least 1, and s, E s, and F s age is at least 2. Lower bound on ages of memory blocks Blocks with a lower bound greater or equal to the cache size are guaranteed not to be in the cache. How is this useful in WET analysis? 28

29 bstract May ache Behavior How do abstract cache states change upon memory accesses? ccess to : potential hit ccess to E: definite miss {B} {} {E} {F} {B} {} {,} {F} {B} {} {,} {F} Notice subtle difference to must update! 29

30 Join for bstract May ache States {,} {F} {} {}? {E} = {} {} {,} {E} {F} {} à Take the minimum of the age bounds! 30

31 Timing Predictability Uncertainty in WET nalysis distribution of execution times nalysis-guaranteed timing bounds Overest.= uncertainty penalty LB BET WET UB Execution time Precision of WET analysis determined by amount of uncertainty Uncertainty in cache analysis depends on replacement policy 31

32 Uncertainty in ache nalysis read z 1. Initial cache contents unknown. read y read x 2. ifferent paths lead to these points. 3. annot resolve address of z. write z =) mount of uncertainty determined by ability to recover information 32

33 ache Predictability Metrics Evict Fill [fed] [gfe] [dex] [fec] [fde] [gfd] [hgf ] omplete Uncertainty omplete ertainty 33

34 Interpretation of Predictability Metrics Evict: Fill: l Number of accesses until any analysis can start predicting guaranteed cache misses l Number of accesses until any analysis can precisely predict any access as hit or miss à The two metrics bound the precision of any static cache analysis. an thus serve as benchmark for analyses. 34

35 Popular ache Replacement Policies Least-Recently-Used (LRU) used in INTEL PENTIUM I, MIPS 24K/34K, M OPTERON First-In First-Out (FIFO) used in MOTOROL POWERP 56X, INTEL XSLE, RM9, RM11 Not Most-Recently-Used (NMRU) used in INTEL ITNIUM Pseudo-LRU (PLRU) used in INTEL PENTIUM II-IV, INTEL ORE, INTEL XEON, POWERP 75X 35

36 Observation: LRU Replacement is Robust ccess to ccess to B ccess to ccess to {} {B} {} {} {B} {} {} {} {B} {} rbitrary ache State à Predictability Metrics: Evict(k) = Fill(k) = k B where k = associativity 36

37 Predictability Metrics: FIFO Like LRU in the miss case But: Ignores hits a b c d? a b c? a b c? a b c? a b c d? a b In the worst case k-1 hits and k misses: (k = associativity) à Evict(k) = 2k-1 nother k accesses to obtain complete knowledge: à Fill(k) = 3k-1 37

38 Predictability Metrics: PLRU Tree bits point to block to be replaced 1 c 0 e a b c d a b c d a e c d ccesses rejuvenate neighborhood l ctive blocks keep their (inactive) neighborhood in the cache nalysis yields: l Evict(k) = k/2 log 2 k +1 l Fill(k) = k/2 log 2 k + k

39 Evaluation of Policies Policy Evict(k) Fill(k) LRU k k FIFO 2k-1 3k-1 NMRU 2k-2 3k-4 PLRU k/2 log k + 1 k/2 log k + k-1 1. LRU is optimal w.r.t. metrics à Use LRU when you have the choice. 2. How to build static analyses that are optimal w.r.t. metrics? à [SIGMETRIS, LTES, SS, WET, ERTS] 39

40 onclusions ache nalysis for Least-Recently-Used: l Efficiently represents sets of cache states by bounding the age of memory blocks From above: must analysis From below: may analysis l Requires context sensitivity for precision ache Predictability Metrics: l Equate predictability with forgetfulness l LRU is particularly forgetful 40

41 Literature bstract ousot, ousot: bstract interpretation: a unified lattice model for static Interpretation: analysis of programs by construction or approximation of fixpoints, In: Proceedings POPL, 1977 LRU: Predictability: Other Policies: FIFO: Persistence: NMRU: Survey: Ferdinand, Wilhelm: Efficient and precise cache behavior prediction for realtime systems, Real-Time Systems, 1999 Reineke, Grund, Berg, Wilhelm: Timing predictability of cache replacement policies, Real-Time Systems 37(2), 2007 Reineke, Grund: Relative competitive analysis of cache replacement policies, In: Proceedings LTES, 2008 Grund, Reineke: bstract interpretation of FIFO replacement, In: Proceedings SS, 2009 Grund, Reineke: Precise and efficient FIFO-replacement analysis based on static phase detection, In: Proceedings ERTS, 2010 Guan, Yang, Lv, Yi: FIFO cache analysis for WET estimation: a quantitative approach, In: Proceedings TE, 2013 ullmann: ache persistence analysis: Theory and practice, M TES, 2013 Guan, Lv, Yi, Yu: WET analysis with MRU cache: challenging LRU for predictability, M TES, 2014 Lv, Guan, Reineke, Wilhelm, Yi: survey on static cache analysis for realtime systems, LITES 3(1),