Ascertaining Uncertainty for Efficient Exact Cache Analysis

TL;DR

This paper introduces a novel static cache analysis method that combines abstract interpretation and model checking to precisely determine cache hits and misses, improving accuracy over traditional approaches.

Contribution

It presents a new approach that reduces uncertainty in cache analysis by integrating abstract interpretation with model checking for exact results.

Findings

Improves precision of cache hit/miss classification.

Reduces uncertainty in static cache analysis.

Maintains reasonable computational cost.

Abstract

Static cache analysis characterizes a program's cache behavior by determining in a sound but approximate manner which memory accesses result in cache hits and which result in cache misses. Such information is valuable in optimizing compilers, worst-case execution time analysis, and side-channel attack quantification and mitigation.Cache analysis is usually performed as a combination of `must' and `may' abstract interpretations, classifying instructions as either `always hit', `always miss', or `unknown'. Instructions classified as `unknown' might result in a hit or a miss depending on program inputs or the initial cache state. It is equally possible that they do in fact always hit or always miss, but the cache analysis is too coarse to see it.Our approach to eliminate this uncertainty consists in (i) a novel abstract interpretation able to ascertain that a particular instruction may definitely cause a hit and a miss on different paths, and (ii) an exact analysis, removing all remaining uncertainty, based on model checking, using abstract-interpretation results to prune down the model for scalability.We evaluated our approach on a variety of examples; it notably improves precision upon classical abstract interpretation at reasonable cost.