Fast and exact analysis for LRU caches

Abstract

For applications in worst-case execution time analysis and in security, it is desirable to statically classify memory accesses into those that result in cache hits, and those that result in cache misses. Among cache replacement policies, the least recently used (LRU) policy has been studied the most and is considered to be the most predictable.The state-of-the-art in LRU cache analysis presents a tradeoff between precision and analysis efficiency: The classical approach to analyzing programs running on LRU caches, an abstract interpretation based on a range abstraction, is very fast but can be imprecise. An exact analysis was recently presented, but, as a last resort, it calls a model checker, which is expensive.In this paper, we develop an analysis based on abstract interpretation that comes close to the efficiency of the classical approach, while achieving exact classification of all memory accesses as the model-checking approach. Compared with the model-checking approach we observe speedups of several orders of magnitude. As a secondary contribution we show that LRU cache analysis problems are in general NP-complete.

On the Complexity of Cache Analysis for Different Replacement Policies

“…In this section, we shall extend our recent NP-hardness results [15] to NPcompleteness, and also prove NP-hardness for exist-hit on a restricted class of control-flow graphs.…”

Cache Persistence Analysis: Finally Exact

“…Thus, the path π = pre • (s i , b, s i+1 ) • mid • (s j , b, s j+1 ) is also a witness to the fact that b is not persistent, and its length is bounded by |V | + |V | · |E| + 2, i. e., it is polynomial in the size of the control-flow graph G. Now we show that the persistence problem is NP-hard. This part of the proof is analogous to Touzeau et al's proof that LRU must analysis is NP-hard [28].…”

“…The development of the exact persistence analyses in this paper has been inspired by recent work of Touzeau et al [28], in which they develop exact must and may analyses for LRU caches. Similarly to our persistence analysis, their implementation employs ZDDs to compactly represent sets of sets of memory blocks and their abstraction exploits the monotonicity of LRU replacement to reduce the number of sets to track.…”

“…Similarly to our persistence analysis, their implementation employs ZDDs to compactly represent sets of sets of memory blocks and their abstraction exploits the monotonicity of LRU replacement to reduce the number of sets to track. Besides solving a related but different problem, our analysis adds support for the efficient analysis of data caches as discussed in Section IV and unlike [28] we evaluate the analysis in the context of WCET analysis.…”

Imprecision in WCET estimates due to library calls and how to reduce it (WIP paper)

“…Moreover, the summaries must be kept precise enough to yield a tight WCET, but AI techniques tend to overapproximate in the presence of complex control flows and data dependencies [5,21]. Antichains [19] could be used to the cache states with less overapproximation than traditional cache analyses [11], while still maintaining scalability. Additionally, the use of relational domains like in APRON [13] could alleviate the imprecision, but comes at the cost of higher computational complexity.…”