An efficient control-oriented coverage metric

Remote attestation is a crucial security service particularly relevant to increasingly popular IoT (and other embedded) devices. It allows a trusted party (verifier) to learn the state of a remote, and potentially malware-infected, device (prover). Most existing approaches are static in nature and only check whether benign software is initially loaded on the prover. However, they are vulnerable to runtime attacks that hijack the application's control or data flow, e.g., via return-oriented programming or data-oriented exploits. As a concrete step towards more comprehensive runtime remote attestation, we present the design and implementation of Control-FLow ATtestation (C-FLAT) that enables remote attestation of an application's control-flow path, without requiring the source code. We describe a full prototype implementation of C-FLAT on Raspberry Pi using its ARM TrustZone hardware security extensions. We evaluate C-FLAT's performance using a real-world embedded (cyber-physical) application, and demonstrate its efficacy against control-flow hijacking attacks.

A reverse engineering model for C programs

This paper presents BPUFuzzer, a fuzz testing tool for detecting branching transient execution vulnerabilities in CPU RTL design. BPUFuzzer addresses two key challenges: generating testcases that capture complex control flows, and extracting essential data from vast hardware states to guide testcase selection. Utilizing a control flow graph-based testcase generation strategy with anomaly detection and employing fitness and coverage metrics, BPUFuzzer works on testcases that cover broader program flows and deliberately selects testcases to discover transient execution vulnerabilities effectively. When applied on RISC-V Boom v3, BPUFuzzer uncovered more Spectre types than the state-of-the-arts, including a previously unidentified variant, named Spectre-LOOP.

Much of the previous work on modulo scheduling has targeted numeric programs, in which, often, the majority of the loops are well-behaved loop-counter-based loops without early exits. In control-intensive non-numeric programs, the loops frequently have characteristics that make it more difficult to effectively apply modulo scheduling. These characteristics include multiple control flow paths, loops that are not based on a loop counter, and multiple exits. In these loops, the presence of unimportant paths with high resource usage or long dependence chains can penalize the important paths. A path that contains a hazard such as another nested loop can prohibit modulo scheduling of the loop. Control dependences can severely restrict the overlap of the blocks within and across iterations. This paper describes a set of methods that allow effective modulo scheduling of loops with multiple exits. The techniques include removal of control dependences to enable speculation, extensions to modulo variable expansion, and a new epilogue generation scheme. These methods can be used with superblock and hyperblock techniques to allow modulo scheduling of the selected paths of loops with arbitrary control flow. A case study is presented to show how these methods, combined with superblock techniques, enable module scheduling to be effectively applied to control-intensive non-numeric programs. Performance results for several SPEC CINT92 benchmarks and Unix utility programs are reported and demonstrate the applicability of modulo scheduling to this class of programs.

Software testing is an important stage of the software development life cycle. However, the test execution is time-consuming and costly. To accelerate the test execution, researchers have applied several methods to run the testing in parallel. One method of parallelizing the test execution is by using a GPU machine to distribute test case inputs among several threads running in parallel. However, when testing a program on a GPU, different test case inputs could have different control flow paths. This leads to branch divergence which may increase the execution time of testing. In addition, transferring data between host and device may increase the execution time of the test execution when data are allocated statically instead of dynamically. Also, different data sizes from different test case inputs may increase the number of memory transactions. To address these challenges, three studies were conducted. The first study investigated three programming models: CUDA Unified Memory, CUDA Non-Unified Memory, and OpenMP GPU Offloading to parallelize the test execution. This study utilized 11 benchmarks and parallelized their test suites by using these models. The evaluation was based on their performance in terms of execution time. The results showed that using CUDA Unified Memory to implement a test suite for GPU was the easiest and most productive programming model among the other two models. The second study discussed three challenges (control flow, memory access pattern, and input size of a program) when parallelizing test execution on two major computing platforms: multi-core CPU and GPU. It analyzed 14 programs from different domains to evaluate parallelizing test execution on the two platforms. The results showed that the cache size of a GPU and branch divergence significantly increase the execution time of many test suites of programs. The last study proposed a novel algorithm to minimize the branch divergence when testing an application on a GPU. Essentially, the algorithm arranges test inputs based on the warp size of a GPU. Test inputs that have similar control flow paths are grouped within the same warp to be executed in parallel. The validation and evaluation were conducted on six different domains of benchmarks (57 programs in total). The results showed that the algorithm speeds up the testing execution up to 3.8x and improves the warp execution efficiency up to 15x. Therefore, the algorithm reduces the branch divergence by minimizing the number of inactive threads per warp.

Dataflow analysis for energy-efficient scratch-pad memory management

High computational effort in modern signal and image processing applications often demands for special purpose accelerators in a system on chip (SoC). New high level synthesis methodologies enable the automated design of such programmable or non-programmable accelerators. Loop tiling is a widely used transformation in such methodologies for dimensioning of such accelerators in order to match inherent massive parallelism of considered algorithms with available functional units and processor elements. Innately, the applications are data-flow dominant and have almost no control flow, but the application of tiling techniques has the disadvantage of a more complex control and communication flow. In this paper, we present a methodology for the automatic generation of the control engines of such accelerators. The controller orchestrates the data transfer and computation. The effect of tiling on area, latency, and power overhead of the controller is studied in detail. It is shown that the controller has a substantial overhead of up to 50% in for different tiling and throughput parameters. The energy-delay product is also used as a metric for identifying optimal accelerator designs.

We present a real world experience with some recent research results aimed at improving the branch testing process. The results considered consist into (i) a method for the automatic derivation of sets of paths that satisfy the branch testing criterion and into (ii) a bound on the number of test paths needed for achieving 100% branch coverage. The derivation of test path sets (point i) is based on a new method for the static analysis of the program flowgraph; the method has been implemented within a prototype tool, called BAT. The computation of the bound (point ii), called βbranch,considers those control flow paths with a low number of predicates, that are more likely feasible. BAT and βbranch have been validated on object oriented C++ software, developed to control a new generation of telecommunications systems, within the test environment of Ericsson Telecomunicazioni. The case study regarded the basic test phase, that is the first step of the testing process and is appropriate for the application of the proposed theory, since it includes the branch testing of program units up to a prescribed coverage measure. While the experimentation is still on-going, we describe some preliminary results.

With the industry completing longer and more difficult intervals, both on- and offshore, completion techniques and equipment must support sand-free hydrocarbon flow to provide economic feasibility. Traditional equipment often has failed to meet these needs. For example, when horizontal wells with high permeability are gravel packed, problems relating to integrity of drill-in fluid wall cake, fracture initiation during pack placement, borehole instability, well bore failure, and hole-size irregularities can occur. These scenarios can prevent complete packing of the screen downstream, which can severely compromise production potentials and the life of the well equipment. A unique multiple-path gravel-pack screen has been designed to address these needs and provide reliable horizontal gravel packs. The system is easy to run, and provides multiple flow paths - the traditional annular path, a concentric annular path between the screen and outer shroud, and integral channels surrounding the screen. The screen, channels and base-pipe connections are integral with each joint so that no additional assembly other than the standard pin-to-box makeup is required on the rig floor. Washpipe is run inside the screen to carry fluid circulation for alpha - beta wave annular packing. The channel slurry exit port configuration radially directs the slurry into the annulus and away from the screen. Candidates for the system include horizontal wells with high-permeability zones, zones prone to fracturing during gravel-pack treatment, and wells with active shale sections or hole-size irregularities that can result in blockages. In full scale testing of 300 feet of screen, the assembly reliably demonstrated a 100% pack using two different gravel/gel systems. The multiple path screen enabled the slurry to flow past annular blockages using both a low-friction concentric annular pathway with fluid returns and controlled leakoff slurry channels to finish the packing process. The Challenge Reliability of sand-control completions continues to be a key factor in the economics of producing oil and gas from unconsolidated sand reservoirs. In many cases, gravel pack life can make or break the economic viability of a project. Areas with high cost of rig operation and well intervention are particularly affected. These locations include many of the more promising plays such as deep water, areas of new development (like China), and places where logistics and lack of infrastructure drive high costs. In these areas, economic success can hinge on the capability to complete long, deviated, complex or horizontal sand intervals to efficiently capture reserves. But, successful installation of the sand-control completion is only the first step to attaining economic success. Long-term production is also required to meet the high capital outlays and high production costs on these projects. Only by achieving the above requirements as well as eliminating the need for well intervention can the planned economic returns be realized. New sand-control completion methods continue to evolve, and older completion techniques have been improved in an effort to help operators meet these challenges. Whereas gravel packs and bare-screen completions used to be considered the preferred completion techniques, frac packs and horizontal gravel packs now seem more capable of offering increased productivity and long-term reliability.

We study programs with integer data, procedure calls and arbitrary call graphs. We show that, whenever the guards and updates are given by octagonal relations, the reachability problem along control flow paths within some language \(w_1^* \ldots w_d^*\) over program statements is decidable in Nexptime. To achieve this upper bound, we combine a program transformation into the same class of programs but without procedures, with an Np-completeness result for the reachability problem of procedure-less programs. Besides the program, the expression \(w_1^* \ldots w_d^*\) is also mapped onto an expression of a similar form but this time over the transformed program statements. Several arguments involving context-free grammars and their generative process enable us to give tight bounds on the size of the resulting expression. The currently existing gap between Np-hard and Nexptime can be closed to Np-complete when a certain parameter of the analysis is assumed to be constant.

Chunks: A basis for complexity measurement

sushi and tardis are two automatic test generators for Java programs. They generate test suites, aiming to satisfy the branch coverage adequacy criterion. Both tools exploit symbolic execution to analyze the control flow paths of the program under test and generate path conditions, i.e., constraints on the program inputs that determine the execution of a path, focusing in particular on control flow paths that lead to uncovered branches. Then, sushi and tardis exploit these path conditions with a search-based algorithm to generate unit tests (in JUnit) that execute those program paths. In this paper we report the results of sushi and tardis at the seventh edition of the unit testing tool competition at the 2019 edition of the International Workshop on Search-Based Software testing.

A precondition verification system for high-level (register-transfer-level) design transformations is described. The system can verify spatial preconditions in terms of the data path composition and topology, as well as temporal preconditions in terms of assertions on the control flow paths. The system is implemented in Prolog and incorporates a mixture of techniques including symbolic equivalence and partial evaluation to effectively verify the preconditions in the presence of arbitrarily nested data-dependent decision points (conditional and iterative constructs) in the control graph. An example which shows how the system can be used for precondition verification is presented. >

This article considers parallel systems to be a broader topic than the mapping of single algorithms to parallel processors. This strategy allows for a discussion of general principles, rather than the techniques that apply to specific machines. Much of the present parallel hardware industry provides machines that do not support a parallel machine model as needed for software engineering practices, therefore, this strategy is necessary. Massively parallel machines are organized for selected algorithm approaches that attain high performance at the sacrifice of software productivity because unacceptable application constraints result when building complete parallel systems with multiple algorithms and application domains. For these machines the goals of software engineering practices cannot be met. Some parallel machines do support a suitable parallel machine model for software engineering, but these have a maximum processor count which limits peak performance. To better discuss parallel systems two styles are introduced: intensive and extensive . Extensive concurrent applications are those that are too complex and interrelated to have a recognizable and predictable response structure. Intensive algorithms are those that have predictable data and control flow paths. Both styles require software engineering methods and tools and are sufficiently different from each other so that the style must be stated for any rational and reasonable discussion.

In this paper, we introduce novel compiler optimization techniques to reduce the number of operations performed in critical sections that occur in explicitly-parallel programs. Specifically, we focus on three code transformations: 1) Partial Strength Reduction (PSR) of critical sections to replace critical sections by non-critical sections on certain control flow paths; 2) Critical Load Elimination (CLE) to replace memory accesses within a critical section by accesses to scalar temporaries that contain values loaded outside the critical section; and 3) Non-critical Code Motion (NCM) to hoist thread-local computations out of critical sections. The effectiveness of the first two transformations is further increased by interprocedural analysis. The effectiveness of our techniques has been demonstrated for critical section constructs from three different explicitly-parallel programming models - the isolated construct in Habanero Java (HJ), the synchronized construct in standard Java, and transactions in the Java-based Deuce software transactional memory system. We used two SMP platforms (a 16-core Intel Xeon SMP and a 32-Core IBM Power7 SMP) to evaluate our optimizations on 17 explicitly-parallel benchmark programs that span all three models. Our results show that the optimizations introduced in this paper can deliver measurable performance improvements that increase in magnitude when the program is run with a larger number of processor cores. These results underscore the importance of optimizing critical sections, and the fact that the benefits from such optimizations will continue to increase with increasing numbers of cores in future many-core processors.