• 270 likes • 412 Vues
GameTime : A Toolkit for Timing Analysis of Software. Sanjit Seshia and Jonathan Kotker EECS Department, UC Berkeley TACAS 2011, Saarbrücken , Germany. Motivation. Quantitative analysis of programs is crucial for cyber-physical systems: How long does it take?
E N D
GameTime: A Toolkit for Timing Analysis of Software SanjitSeshia and Jonathan Kotker EECS Department, UC Berkeley TACAS 2011, Saarbrücken, Germany
Motivation Quantitative analysis of programs is crucial for cyber-physical systems: How long does it take? How much energy does it consume? • Safety-critical embedded systems: Does the brake-by-wire software always actuate the brakes within 1 ms? • Energy-limited sensor nets: How much energy must the sensor node harvest for RSA encryption?
Timing Analysis Problems • Worst-case execution time (WCET) estimation • Estimating distribution of execution times • Threshold property: produce test cases that violates program deadline • Software-in-the-loop simulation: predict execution time of particular program path All of the above involve predicting an execution time property!
i1 42 75 i2 LEARNINGALGORITHM online i3 101 … … SMT SOLVER SMT SOLVER The GameTime Approach Game-Theoretic Online Learning + Satisfiability Modulo Theories Generate Control-Flow Graph, Unroll Loops, Inline Functions, and so on CONTROL-FLOW GRAPH (DAG) PROGRAM Compile Program for Platform i3 i2 Extract FEASIBLE BASIS PATHS with corresponding Test Cases TEST SUITE i1 Measure timing on Test Suite directed by Learning Algorithm PREDICT TIMING PROPERTIES (such as worst-case, distribution) Publication: S. A. Seshia and A. Rakhlin, Quantitative Analysis of Systems Using Game-Theoretic Learning, ACM Trans. on Embedded Computing Systems
Theoretical Model and Guarantees Game Formulation: Tool vs. Platform Sample Theoretical Guarantee for WCET: GameTime finds program path leading to WCET with high probability, under certain assumptions on platform behavior (see ACM TECS paper for details) 5
Running Example:Modular Exponentiation • Common operation in cryptography, used for public-key encryption and decryption. • Base number is raised to an exponent, and result is expressed modulo a prime number. • Exponentiation is performed usingsquare-and-multiply, where the exponent is progressively divided by two, while the base is progressively squared.
Modular Exponentiation modexp(base, exponent) { result = 1; for(i=EXP_BITS; i>0; i--) { // EXP_BITS = 2 if ((exponent & 1) == 1) { result = (result * base) % p; } exponent >>= 1; base = (base * base) % p; } return result; } modexp(base, exponent) { result = 1; if ((exponent & 1) == 1) { result = (result * base) % p; } exponent >>= 1; base = (base * base) % p; • if ((exponent & 1) == 1) { • result = (result * base) % p; • } • exponent >>= 1; • base = (base * base) % p; return result; }
1 3 2 4 5 7 6 8 9 Basis Paths 1 1 1 1 Edge labels indicate Edge IDs and positions in vector representation 3 3 2 2 x1= (1, 0, 1, 1, 1, 1, 0, 0, 1) x2= (1, 1, 0, 0, 1, 0, 1, 1, 1) x3 = (1, 1, 0, 0, 1, 1, 0, 0, 1) x4 = (1, 0, 1, 1, 1, 0, 1, 1, 1) 4 4 5 5 5 5 7 7 6 6 x4= x1+ x2 – x3 8 8 9 9 9 9 (d) Vector representations (a) CFG for modexp (unrolled) (b) Basis paths x1, x2, x3 (c) Additional path x4
1 3 2 4 5 7 6 8 9 Basis Generation Example 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Use ILP solver to pick path in graph
1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes
1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes
1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 1 1 0 0 1 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes
1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 1 1 0 0 1 0 1 1 1 1 0 1 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes, but linearly dependent!
1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 1 1 0 0 1 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Basis paths
Basis Generation ExampleUsing the Unsat-Core void foo (int a, int b) { if (a != b) { c = 1; } switch(c) { case 0: ... break; case 1: ... break; default: ... } ... } 1 3 2 4 5 6 7 8 10 11 9 12
Basis Generation Example 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 3 2 Use ILP solver to pick path in graph. 4 5 6 7 8 10 11 9 12
Basis Generation Example 1 0 1 1 1 1 0 0 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 3 2 4 Feasible? SMT solver says No! 5 6 7 8 10 11 9 12
Basis Generation Example 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 3 From unsat-core, add constraint that edges 3, 4, 6, 9 cannot occur together on the same path and retry. 2 4 5 6 7 8 Add constraint x3 + x4 + x6 + x9 <= 3 10 11 9 12
Predicted and Measured DistributionsModular Exponentiation with Base 2 and 5-bit exponents StrongARM-1100 Processor
Percentage Error with Different Initial States Modular Exponentiation with Base 15 and 5-bit exponents StrongARM-1100 Processor
Percentage Error with Different Initial States Modular Exponentiation with Base 15 and 5-bit exponents StrongARM-1100 Processor
Predicted and Measured Values Modular Exponentiation with Base 2 and 5-bit exponents TI MSP430 Processor on TelosB Mote
Predicted and Measured Values Modular Exponentiation with Base 15 and 5-bit exponents TI MSP430 Processor on TelosB Mote
Highlights of OtherExperimental Results (details in ICCAD’08, ACM TECS papers) • GameTime is efficient For example, 7 x 1016 total paths vs. < 200 basis paths • Sampling basis paths tells us about longer paths we do not sample Found paths 25% longer than sampled basis • GameTime can accurately estimate the distribution of execution times with few measurements Measure basis paths, predict other paths • GameTimecan demonstrate larger WCET estimateswith test cases than some conservative WCET estimation tools
Availability An alpha version of GameTime will be available online at http://uclid.eecs.berkeley.edu/gametime within the next month.
Thank you! Acknowledgments: Andrew Chan, Sagar Jain, Dorsa Sadigh, Min Xu, Lisa Yan