Abstract interpretation under speculative execution
Abstract interpretation under speculative execution
复制标题
DOI：
10.1145/3314221.3314647
复制
发表时间：
2019-04
期刊：
影响因子：
--
通讯作者：
Meng Wu;Chao Wang
中科院分区：
文献类型：
--
作者：
Meng Wu;Chao Wang
分析在支持投机执行的处理器上运行的程序的行为对于诸如执行时间估计和侧渠道检测等应用程序至关重要。不幸的是，基于抽象解释的现有静态分析技术不能模拟投机性执行，因为它们专注于程序的功能属性，而推测执行不会改变功能。为了填补空白，我们提出了一种在投机执行下制作抽象解释声音的方法。有两个贡献。首先，我们将虚拟控制流的概念介绍给可能被推测执行的说明，从而影响后续指令。其次，为了提高分析，我们提出了优化来处理合并和循环并安全地绑定投机执行深度。我们已经在静态缓存分析中实现并评估了所提出的方法，以进行执行时间估计和侧渠道检测。我们的实验表明，新方法虽然在投机性执行下保证声音，但优于可能不健全的最先进的抽象解释技术。
Analyzing the behavior of a program running on a processor that supports speculative execution is crucial for applications such as execution time estimation and side channel detection. Unfortunately, existing static analysis techniques based on abstract interpretation do not model speculative execution since they focus on functional properties of a program while speculative execution does not change the functionality. To fill the gap, we propose a method to make abstract interpretation sound under speculative execution. There are two contributions. First, we introduce the notion of virtual control flow to augment instructions that may be speculatively executed and thus affect subsequent instructions. Second, to make the analysis efficient, we propose optimizations to handle merges and loops and to safely bound the speculative execution depth. We have implemented and evaluated the proposed method in a static cache analysis for execution time estimation and side channel detection. Our experiments show that the new method, while guaranteed to be sound under speculative execution, outperforms state-of-the-art abstract interpretation techniques that may be unsound.