Context-sensitive timing simulation of binary embedded software

We present an approach to accurately simulate the temporal behavior of binary embedded software based on timing data generated using static analysis. As the timing of an instruction sequence is significantly influenced by the microarchitecture state prior to its execution, which highly depends on the preceding control flow, a sequence must be separately considered for different control flow paths instead of estimating the influence of basic blocks or single instructions in isolation. We handle the thereby arising issue of an excessive or even infinite number of different paths by considering different execution contexts instead of control flow paths. Related approaches using context-sensitive cycle counts during simulation are limited to simulating the control flow that could be considered during analysis. We eliminate this limitation by selecting contexts dynamically, picking a suitable one when no predetermined choice is available, thereby enabling a context-sensitive simulation of unmodified binary code of concurrent programs, including asynchronous events such as interrupts. In contrast to other approximate binary simulation techniques, estimates are conservative, yet tight, making our approach reliable when evaluating performance goals. For a multi-threaded application the simulation deviates only by 0.24% from hardware measurements while the average overhead is only 50% compared to a purely functional simulation.