Backing Store Research Articles

Physics-Driven Page Fault Handling for Customized Deception against CPS Malware

Malware crafted to attack cyber-physical systems such as the electrical power grid have a physics-centric nucleus. Cyber-physical systems malware understand physics and hence use their knowledge to guide how they initiate physical damage on a compromised industrial computer. We develop a physics-driven page fault handler in the seL4 microkernel, which, in addition to reducing the page fault rate, differentiates active physics in main memory from passive physics in the backing store. We aid the identification of active physics via a CPU scheduler that tracks the evolution of active physics over time. We exploit the concept of active physics to develop deception that is customized to attack the physics-centric nucleus of malware. We evaluated this research against a variety of malware samples and techniques, including both numerous samples from publicly available repositories and custom-made academic code, and present our findings in the article. The physics data of reference pertain to an electrical substation, with a higher focus on a power transformer and related industrial computer algorithms.

NUDA: Non-Uniform Directory Architecture for Scalable Chip Multiprocessors

Chip multiprocessors (CMPs) involve directory storage overhead if cache coherence is realized via sharer tracking. This work proposes a novel framework dubbed n on- u niform d irectory a rchitecture (NUDA), by leveraging our two insights in that the number of “active” directory entries required to stay on chip is usually small for a short execution time window due to high directory locality, and that the fraction of interrogated directory entries drops as the core count rises. Unlike earlier storage overhead reduction techniques that require all cached LLC blocks to have their directory entries fully on chip, NUDA dynamically buffers only most active d irectory v ectors (DVs) on chip while keeping DVs of all LLC blocks in a backing store at low level storage. NUDA attains its superior efficiency via an inventive c riticality- a ware r eplacement p olicy (CARP) for on-chip buffer management and effective prefetching to p re- a ctivate ve ctors (PAVE) for upcoming coherence interrogations. We have evaluated NUDA by gem5 simulation for 64-core CMPs under PARSEC and SPLASH benchmarks, demonstrating that CARP and PAVE enhance on-chip directory storage efficiency significantly. NUDA with a small on-chip buffer for DVs exhibits negligible performance degradation (to stay within 2.6 percent) compared to a full on-chip directory, while outperforming its previous counterparts for directory area reduction when on-chip directory budget is provisioned scarcely for high scalability.

Cold object identification in the Java virtual machine

Many Java applications instantiate objects within the Java heap that are persistent but seldom if ever referenced by the application. Examples include strings, such as error messages, and collections of value objects that are preloaded for fast access. This paper describes a stack-based framework for detecting these 'cold' objects at runtime, with a view to marshaling and sequestering them in designated regions of the heap where they may be preferentially paged out to a backing store, thereby freeing physical memory pages for occupation by more active objects. Furthermore, we evaluate the correctness and efficiency of stack-based approach with an access barrier. The experimental results from a series of SPECjvm2008 benchmarks are presented. Copyright © 2016 John Wiley & Sons, Ltd.

Memory organizations for 3D-DRAMs and PCMs in processor memory hierarchy

In this paper, we describe and evaluate three possible architectures for using 3D-DRAMs and PCMs in the processor memory hierarchy. We explore: (i) using 3D-DRAM as main memory with PCM as backing store; (ii) using 3D-DRAM as the Last Level Cache and PCM as the main memory; and (iii) using both 3D-DRAM and PCM as main memory. In each of these configurations, since the proposed memories are significantly faster than today’s off-chip 2D DRAMs for main memories and magnetic hard drives for secondary storage, we introduce hardware assistance to speedup virtual to physical address translation. We use Simics, a full system simulator, and benchmarks from both SPEC and OLTP suites to evaluate our designs. We use CACTI for obtaining energy and latency values for our configurations. We measure energy consumed and execution performance for the selected benchmarks. Our studies lead to the following conclusions. The best performance is obtained when 3D-DRAMs are used as last level caches (LLC) and PCM as the main memory. However, this organization performs poorly in terms of energy consumed. Our 3D-DRAM together with PCM as main memory is the best choice in terms of energy consumed. In terms of write-backs, 3D-DRAM as LLC causes fewer writes to PCM than the other organization. These experiments can be extended to explore specific memory organizations, capacities of 3D-DRAM needed as LLC or main memory and how the hybrid PCM/DRAM memory should be used for specific application contexts.

In lieu of swap: Analyzing compressed RAM in Mac OS X and Linux

The forensics community is increasingly embracing the use of memory analysis to enhance traditional storage-based forensics techniques, because memory analysis yields a wealth of information not available on non-volatile storage. Memory analysis involves capture of a system's physical memory so that the live state of a system can be investigated, including executing and terminated processes, application data, network connections, and more. One aspect of memory analysis that remains elusive is investigation of the system's swap file, which is a backing store for the operating system's virtual memory system. Swap files are a potentially interesting source of forensic evidence, but traditionally, most swap file analysis has consisted of string searches and scans for small binary structures, which may in some cases be revelatory, but are also fraught with provenance issues. Unfortunately, more sophisticated swap file analysis is complicated by the difficulty of capturing mutually consistent memory dumps and swap files, the increasing use of swap file encryption, and other issues. Fortunately, compressed RAM facilities, such as those in Mac OS X Mavericks and recent versions of the Linux kernel, attempt to reduce or eliminate swapping to disk through compression. The storage of compressed pages in RAM both increases performance and offers an opportunity to gather digital evidence which in the past would have been swapped out. This paper discusses the difficulty of analyzing swap files in more detail, the compressed RAM facilities in Mac OS X and Linux, and our new tools for analysis of compressed RAM. These tools are integrated into the open-source Volatility framework.

An automated timeline reconstruction approach for digital forensic investigations

Existing work on digital forensics timeline generation focuses on extracting times from a disk image into a timeline. Such an approach can produce several million ‘low-level’ events (e.g. a file modification or a Registry key update) for a single disk. This paper proposes a technique that can automatically reconstruct high-level events (e.g. connection of a USB stick) from this set of low-level events. The paper describes a framework that extracts low-level events to a SQLite backing store which is automatically analysed for patterns. The provenance of any high-level events is also preserved, meaning that from a high-level event it is possible to determine the low-level events that caused its inference, and from those, the raw data that caused the low-level event to be initially created can also be viewed. The paper also shows how such high-level events can be visualised using existing tools.

Store brand and national brand promotion attitudes antecedents

Retailers compete against national manufacturers by launching store brands. National manufactures regularly use brand promotions to fight store brands back. The purpose of this article is to find out whether attitudes toward national brand promotions and store brands have similar or different conceptual antecedents. The study presents and tests a model of the effects of shoppers´ characteristics (price and non-price-related) on attitudes toward store brand and national brand promotions. The results support that constructs relating to price impact both store brand attitude and national brand promotion attitude, but the strength of some of these relationships differ. Other shopper characteristics like brand loyalty and store loyalty, have similar negative and positive effects, respectively. These slight differences suggest that promotions of national brands might be a good tool for fighting back store brands, but manufacturers need to design and target these promotions carefully in order to avoid head-to-head competition.

Block Gram–Schmidt Orthogonalization

The classical Gram-Schmidt algorithm for computing the QR factorization of a matrix $X$ requires at least one pass over the current orthogonalized matrix $Q$ as each column of $X$ is added to the factorization. When $Q$ becomes so large that it must be maintained on a backing store, each pass involves the costly transfer of data from the backing store to main memory. However, if one orthogonalizes the columns of $X$ in blocks of $m$ columns, the number of passes is reduced by a factor of $1/m$. Moreover, matrix-vector products are converted into matrix-matrix products, allowing level-3 BLAS cache performance. In this paper we derive such a block algorithm and give some experimental results that suggest it can be quite effective for large scale problems, even when the matrix $X$ is rank degenerate.

Secure checkpointing

Fault-tolerant computer systems are increasingly being used in such applications as e-commerce, banking, and stock trading, where privacy and integrity of data are as important as the uninterrupted operation of the service provided. While much attention has been paid to the protection of data explicitly communicated over the Internet, there are also other sources of information leakage that must be addressed. This paper addresses one such source of information leakage caused by checkpointing, which is a common method used to provide continued operation in the presence of faults.Checkpointing requires the communication of memory state information, which may contain sensitive data, over the network to a reliable backing store. Although the method of encrypting all of this memory state information can protect the data, such a simplistic method is an overkill that can result in a significant slowdown of the target application. A much more efficient method is to use incremental checkpointing (IC), in which only the modified memory data is saved in stable storage. This paper examines ways to combine the operations required to perform IC with those required to encrypt this memory state data. Our analysis show that the proposed secure checkpointing schemes increase the overhead by 1.57 when compred to conventional checkpointing schemes, which shows the proposed schemes are feasible.

Dynamic software reconfiguration for fault-tolerant real-time avionic systems

This paper reports on research conducted by Smiths Industries (SI) Aerospace within the Control Technology Programme (CTP), to ascertain the feasibility of hardware fault tolerance via dynamic software reconfiguration and to demonstrate its viability in the context of a typical real-time avionic application. Hardware fault-tolerant (FT) systems require the physical replication of hardware components, with the component being the smallest configurable unit. The research approach adopted here is to segregate fully the software (functionality) from the hardware, and regard the configurable units as the software functions themselves. Failure of a component within a computing module would therefore require dynamically reconfiguring the affected software functions elsewhere within the module. Furthermore, it would be possible to reconfigure individual functions not only over different processors but also to currently active processors if spare processing capacity was available in those processors. The computing platform for conducting the research comprised a message-based multiprocessor module, on which was developed a distributed Operating System layer to support both the initial configuration of the application functions and their reconfiguration as a result of user-instigated failure of the module hardware. Software reconfiguration from both module-local memory and module-external backing store was successfully demonstrated for critical and non-critical functions respectively. Based on the research/development system, a self-contained FT module variant was constructed for integration within the System Digital Control Laboratory (SDCL) at BAe Airbus. This module additionally demonstrated the periodic and aperiodic communication capability of the ARINC 629 Combined Mode Protocol (CP) Databus in supporting both the module's functional operation and configuration/reconfiguration process.

Reducing network latency using subpages in a global memory environment

New high-speed networks greatly encourage the use of network memory as a cache for virtual memory and file pages, thereby reducing the need for disk access. Because pages are the fundamental transfer and access units in remote memory systems, page size is a key performance factor. Recently, page sizes of modern processors have been increasing in order to provide more TLB coverage and amortize disk access costs. Unfortunately, for high-speed networks, small transfers are needed to provide low latency. This trend in page size is thus at odds with the use of network memory on high-speed networks.This paper studies the use of subpages as a means of reducing transfer size and latency in a remote-memory environment. Using trace-driven simulation, we show how and why subpages reduce latency and improve performance of programs using network memory. Our results show that memory-intensive applications execute up to 1.8 times faster when executing with 1K-byte subpages, when compared to the same applications using full 8K-byte pages in the global memory system. Those same applications using 1K-byte subpages execute up to 4 times faster than they would using the disk for backing store. Using a prototype implementation on the DEC Alpha and AN2 network, we demonstrate how subpages can reduce remote-memory fault time; e.g., our prototype is able to satisfy a fault on a 1K subpage stored in remote memory in 0.5 milliseconds, one third the time of a full page.

Reducing network latency using subpages in a global memory environment

New high-speed networks greatly encourage the use of network memory as a cache for virtual memory and file pages, thereby reducing the need for disk access. Because pages are the fundamental transfer and access units in remote memory systems, page size is a key performance factor. Recently, page sizes of modern processors have been increasing in order to provide more TLB coverage and amortize disk access costs. Unfortunately, for high-speed networks, small transfers are needed to provide low latency. This trend in page size is thus at odds with the use of network memory on high-speed networks.This paper studies the use of subpages as a means of reducing transfer size and latency in a remote-memory environment. Using trace-driven simulation, we show how and why subpages reduce latency and improve performance of programs using network memory. Our results show that memory-intensive applications execute up to 1.8 times faster when executing with 1K-byte subpages, when compared to the same applications using full 8K-byte pages in the global memory system. Those same applications using 1K-byte subpages execute up to 4 times faster than they would using the disk for backing store. Using a prototype implementation on the DEC Alpha and AN2 network, we demonstrate how subpages can reduce remote-memory fault time; e.g., our prototype is able to satisfy a fault on a 1K subpage stored in remote memory in 0.5 milliseconds, one third the time of a full page.

Partitioning technique for boundary element method

The partitioning technique and its Fortran subroutines for the solution of a non-symmetrical fully populated matrix system encountered in the boundary element method are presented. The technique is such that the computer backing store is fully utilized and therefore a large-scale problem can be solved with a small computer. The derivation of formulae for this technique is given in detail. A corresponding computer program is developed and verified through two two-dimensional elastostatic problems. The influence of submatrix size on cost of computation time is discussed.

A Hardware Architecture for Switch-Level Simulation

The Mossim Simulation Engine (MSE) is a hardware accelerator for performing switch-level simulation of MOS VLSI circuits [1], [2]. Functional partitioning of the MOSSIM algorithm and specialized circuitry are used by the MSE to achieve a performance improvement of /spl gt/ 300 over a VAX 11/780 executing the MOSSIM II program. Several MSE processors can be connected in parallel to achieve additional speedup. A virtual processor mechanism allows the MSE to simulate large circuits with the size of the circuit limited only by the amount of backing store available to hold the circuit description.

Tools and techniques for teaching microprocessor software development

AbstractDebugging low level language software can be a difficult business—the bare microprocessor lacks the user interface; facilities, such as simulators, provided on another machine can be tedious to use on running or partially working programs. A resolution of this difficulty lies in the harmonious use of a mainframe‐based debugging system and a real microprocessor.This paper describes tools and techniques for the development of low level software for the Intel 8080 microprocessor employing both simulated and real microprocessors. The debugging system allows the user to set up a virtual microprocessor into which programs can be loaded and run and from which a flexible tracing of the executing program can be obtained. The debugging system is built into a general purpose multi‐access operating system and this approach makes it possible to provide the system cheaply to a large number of users. Additionally, users have access to all the general facilities (such as editors) provided by the operating system itself.The system has been implemented on a minicomputer with 60 VDU terminals all of which can be used for interaction with the 8080 simulator or for general interactions with the mainframe operating system. The system has also been implemented in a self‐simulating version to run on a real Intel 8080 microprocessor. Many of the VDUs on the minicomputer are controlled by Intel 8080 microprocessors and it is possible to load and run large Intel 8080 programs which were assembled (and tested) on the mainframe or run the self simulator based debugging system. In this way a range of complementary debugging environments is provided: the simulator on the mainframe with its access to backing store (and, hence, the ability to save trace information), the self simulator on the microprocessor (with its better performance for the single user), and the actual Intel 8080 itself. The user can easily move a partially tested program between environments and thus use the environment which best suits his current phase of testing.

Using cache memory to reduce processor-memory traffic

The importance of reducing processor-memory bandwidth is recognized in two distinct situations: single board computer systems and microprocessors of the future. Cache memory is investigated as a way to reduce the memory-processor traffic. We show that traditional caches which depend heavily on spatial locality (look-ahead) for their performance are inappropriate in these environments because they generate large bursts of bus traffic. A cache exploiting primarily temporal locality (look-behind) is then proposed and demonstrated to be effective in an environment where process switches are infrequent. We argue that such an environment is possible if the traffic to backing store is small enough that many processors can share a common memory and if the cache data consistency problem is solved. We demonstrate that such a cache can indeed reduce traffic to memory greatly, and introduce an elegant solution to the cache coherency problem.

An algorithm for producing course and lecturer timetables

The course assignment method introduced in this paper is similar to Selim (Selim S. M. Comput. Educ. 6, 323–332, 1982) in its representation, being a modification of Almond's method (Almond M. Comput. J. 8, 331–340, 1966). It produced feasible course timetables, as well as lecturers' timetables. It is thought that the method can be applied to solve any course scheduling problem in any university, or institute, without altering the general idea of the method, because the general trend of constraints offered by universities is taken into consideration. The importance of saving storage space is also taken into account. This method was applied to solve the course scheduling problem of the American University in Cairo (AUC), on a small computer without the need of any backing store. The method can be used, and satisfactory results obtained, if all the conflicting courses are essential.

A memory-management unit for the optimal exploitation of a small address space

We make a distinction between virtual memory and address mapping. Virtual memory is concerned with the mapping of a potentially large address space to a small (primary) memory. Address mapping (sometimes called memory management) is concerned with the mapping of a relatively small logical address space (e.g., limited to a 16 bit address) to a potentially large memory (e.g., using a 24 bit address). Memory management is in most cases used to locate the data (and the code) of several independent processes in a single large memory. This enables switching between these processes by simply switching the address map, thus circumventing slow backing store transfers. With the advent of low cost MOS-memory devices, address mapping is a simple construct to exploit mass stores without having to upgrade the basic architecture of a processor, in which the size of the logical address space is a basic design decision.

Users' experience with the ILLIAC IV system and its programming languages

The ILLIAC IV is a unique machine which has led the research and development of lockstep parallel processing. The machine has been operational since 1973, in experimental mode, and since 1975 in full production mode. There has been on the order of a hundred users of the machine and these users and their codes have been well documented. Four languages are available on the machine ranging from high level to machine code. A survey has been conducted of the users in order to determine how the ILLIAC IV has been employed and how the high level programming languages have facilitated the use of this machine. This paper presents the results of that survey.The survey attempts to confirm or eliminate some of the folklore that has grown up around the ILLIAC IV facility. It can be helpful in the design of the next generation of supercomputers and their languages and in the improvement of the present generation of languages. The responses to the survey indicate: 1) that the ILLIAC IV has been accepted by the scientific community; 2) that a wide range of different application areas have used the machine; 3) that users have had to construct their programs so as to minimise the effects of the serious bottleneck created by the movement of data between the main and backing stores; and 4) that the high level programming languages available have insufficient or inefficient structures which at times require the use of machine code.

Efficient calculation of finite element stiffness matrices

A method of increasing the efficiency of the construction of stiffness matrices in the finite element method is described. It considers how the efficiency of coding is affected by array referencing and shows how the restricted use of multisubscript arrays can improve the c.p.u. costs. Use is made of the large core storage areas usually available within finite element packages, together with the optimal use of backing store to keep cartesian derivative information which is sequentially loaded into buffers. An estimate of the efficiency of this method is also given which provides a criterion for its use when the global derivatives are known to be required on a given number of occasions during the core life of a program.