# WCET Analysis Based on Micro-Architecture Modeling for Embedded System Security
## 1 Introduction  
Real-time systems are characterized by the existence of timing constraints, in which tasks must be completed within a limited time frame. In hard real-time systems, missing a deadline can directly impact the system's security. For instance, if an airbag system in a car does not deploy within the required time frame, it could result in severe injury or death during an accident. Ensuring real-time performance is therefore essential for maintaining security in these systems. The Worst-Case Execution Time (WCET) of a computational task is the maximum length of time the task could take to execute on a specific hardware platform. Its offline estimation helps in choosing appropriate scheduling algorithms, ensuring the system's performance, and guarantying the system's energy efficiency [1]. Since the wide application of real-time systems makes real-time analysis of programs particularly important, WCET estimation has been studied extensively [2], and various approaches have been developed to derive such bounds [3]. In embedded systems, ARM processors are considered mainstream because of their high performance, low power consumption, reasonable price, and complete maintenance system. They are particularly prominent in the fields of real-time control, connected automated vehicles, and mobile phones. Thus, the analysis of WCET for ARM processors is crucial. Methods to estimate the WCET of programs on newer ARM platforms like ARMv8 should be provided. Estimating the WCET of a program is difficult because the execution of a program depends on specific hardware [4]. In terms of micro-architecture, modern processors are often equipped with pipelines, caches, branch prediction, and other features. These units not only perform their own functions but also interact with each other. For example, modernprocessors often load multiple cache lines at once when transferring data from memory to cache. When dealing with branch instructions, this loading scheme can lead to additional cache invalidation [5]. When a processor's branch instruction is mispredicted, instructions along the taken branch are fetched and executed, while instructions along the wrong path are undone, incurring a branch misprediction penalty. The branch misprediction penalty can be substantially larger than the pipeline length [6]. These interactions between functional units greatly complicate the analysis of program execution, and there is little research on them [7, 8]. In this paper, we model the ARMv8 ISA and the features of the processor's micro-architecture. These features include cache, dynamic branch predictor, prefetching strategy, and out-of-order pipeline. We also consider the interactions between these features. For example, the cache miss caused by branch prediction and the branch miss caused by the instruction pipeline. We estimate the WCET of a program using a static analysis method. The static estimation is performed by establishing and solving an Integer Linear Programming (ILP) problem using IPET, where the control flow information of the program and the processor's micro-architecture are converted into a series of linear constraints and a target WCET equation. The estimated WCET of a program can be obtained by solving its corresponding ILP problem. Using this process, we present a WCET analysis tool based on the open-source project Chronos [9]. The tool is tested on WCET benchmarks. By comparing the estimated WCET of benchmarks with the observed results, it can be concluded that, in most cases, the analysis performs reliable WCET estimations. Our contributions cam be summarized as follows:  
* We use the IPET static WCET analysis method to estimate the WCET of programs on the ARMv8 platform. * In the analysis, we model features of the micro-architecture of the platform, along with the interactions between them. * We evaluate the performance of our WCET analysis tool by comparing the estimated WCET of benchmarks with the observed results. The results show that our tool can provide reliable WCET estimations.