Low-level Code Research Articles

Identifying shader sub-patterns for GPU performance tuning and architecture design

GPUs are increasingly playing vital roles in the modern technology industry. Improving the GPU performance involves optimizing its architectural design and fine-tuning its software code. However, to achieve this, engineers must investigate codes from as many GPU-related applications as possible to identify code portions that need fine-tuning. Moreover, this effort requires engineers to have good domain knowledge, and their work is made more arduous because the source codes of applications are normally confidential. To this end, we introduce ShaderAnalyzer, a solution leveraging graph mining and machine learning to analyze GPU-executed low-level machine codes and identify their fine-tuning opportunities. Our approach includes representing machine code with graph structure and subsequently identifying frequently occurring substructures within the codes. Optimizing the execution of these substructures can enhance the overall performance of the GPU. In addition, our model leverages these frequent patterns to further facilitate engineers’ tasks by selecting representative patterns to predict and investigate low-efficiency ones. We conduct comprehensive experiments to evaluate the performance of our solution, and the results have been validated by our industry partners. ShaderAnalyzer is an end-to-end framework that helps engineers identify code segments with the highest potential for performance gains after fine-tuning and offers valuable insights for hardware architects in future products design.

A Dependent Nominal Physical Type System for Static Analysis of Memory in Low Level Code

We tackle the problem of checking non-proof-carrying code , i.e. automatically proving type-safety (implying in our type system spatial memory safety) of low-level C code or of machine code resulting from its compilation without modification. This requires a precise static analysis that we obtain by having a type system which (i) is expressive enough to encode common low-level idioms, like pointer arithmetic, discriminating variants by bit-stealing on aligned pointers, storing the size and the base address of a buffer in distinct parts of the memory, or records with flexible array members, among others; and (ii) can be embedded in an abstract interpreter. We propose a new type system that meets these criteria. The distinguishing feature of this type system is a nominal organization of contiguous memory regions, which (i) allows nesting, concatenation, union, and sharing parameters between regions; (ii) induces a lattice over sets of addresses from the type definitions; and (iii) permits updates to memory cells that change their type without requiring one to control aliasing. We provide a semantic model for our type system, which enables us to derive sound type checking rules by abstract interpretation, then to integrate these rules as an abstract domain in a standard flow-sensitive static analysis. Our experiments on various challenging benchmarks show that semantic type-checking using this expressive type system generally succeeds in proving type safety and spatial memory safety of C and machine code programs without modification, using only user-provided function prototypes.

Realistic Realizability: Specifying ABIs You Can Count On

The Application Binary Interface (ABI) for a language defines the interoperability rules for its target platforms, including data layout and calling conventions, such that compliance with the rules ensures “safe” execution and perhaps certain resource usage guarantees. These rules are relied upon by compilers, libraries, and foreign-function interfaces. Unfortunately, ABIs are typically specified in prose, and while type systems for source languages have evolved, ABIs have comparatively stalled, lacking advancements in expressivity and safety. We propose a vision for richer, semantic ABIs to improve interoperability and library integration, supported by a methodology for formally specifying ABIs using realizability models. These semantic ABIs connect abstract, high-level types to unwieldy, but well-behaved, low-level code. We illustrate our approach with a case study formalizing the ABI of a functional source language in terms of a reference-counting implementation in a C-like target language. A key contribution supporting this case study is a graph-based model of separation logic that captures the ownership and accessibility of reference-counted resources using modalities inspired by hybrid logic. To highlight the flexibility of our methodology, we show how various design decisions can be interpreted into the semantic ABI. Finally, we provide the first formalization of library evolution, a distinguishing feature of Swift’s ABI.

WhiteFox: White-Box Compiler Fuzzing Empowered by Large Language Models

Compiler correctness is crucial, as miscompilation can falsify program behaviors, leading to serious consequences over the software supply chain. In the literature, fuzzing has been extensively studied to uncover compiler defects. However, compiler fuzzing remains challenging: Existing arts focus on black- and grey-box fuzzing, which generates test programs without sufficient understanding of internal compiler behaviors. As such, they often fail to construct test programs to exercise intricate optimizations. Meanwhile, traditional white-box techniques, such as symbolic execution, are computationally inapplicable to the giant codebase of compiler systems. Recent advances demonstrate that Large Language Models (LLMs) excel in code generation/understanding tasks and even have achieved state-of-the-art performance in black-box fuzzing. Nonetheless, guiding LLMs with compiler source-code information remains a missing piece of research in compiler testing. To this end, we propose WhiteFox, the first white-box compiler fuzzer using LLMs with source-code information to test compiler optimization, with a spotlight on detecting deep logic bugs in the emerging deep learning (DL) compilers. WhiteFox adopts a multi-agent framework: (i) an LLM-based analysis agent examines the low-level optimization source code and produces requirements on the high-level test programs that can trigger the optimization; (ii) an LLM-based generation agent produces test programs based on the summarized requirements. Additionally, optimization-triggering tests are also used as feedback to further enhance the test generation prompt on the fly. Our evaluation on the three most popular DL compilers (i.e., PyTorch Inductor, TensorFlow-XLA, and TensorFlow Lite) shows that WhiteFox can generate high-quality test programs to exercise deep optimizations requiring intricate conditions, practicing up to 8 times more optimizations than state-of-the-art fuzzers. To date, WhiteFox has found in total 101 bugs for the compilers under test, with 92 confirmed as previously unknown and 70 already fixed. Notably, WhiteFox has been recently acknowledged by the PyTorch team, and is in the process of being incorporated into its development workflow. Finally, beyond DL compilers, WhiteFox can also be adapted for compilers in different domains, such as LLVM, where WhiteFox has already found multiple bugs.

Practical Verification of Smart Contracts using Memory Splitting

SMT-based verification of low-level code requires modeling and reasoning about memory operations. Prior work has shown that optimizing memory representations is beneficial for scaling verification—pointer analysis, for example can be used to split memory into disjoint regions leading to faster SMT solving. However, these techniques are mostly designed for C and C++ programs with explicit operations for memory allocation which are not present in all languages. For instance, on the Ethereum virtual machine, memory is simply a monolithic array of bytes which can be freely accessed by Ethereum bytecode, and there is no allocation primitive. In this paper, we present a memory splitting transformation guided by a conservative memory analysis for Ethereum bytecode generated by the Solidity compiler. The analysis consists of two phases: recovering memory allocation and memory regions, followed by a pointer analysis. The goal of the analysis is to enable memory splitting which in turn speeds up verification. We implemented both the analysis and the memory splitting transformation as part of a verification tool, CertoraProver, and show that the transformation speeds up SMT solving by up to 120x and additionally mitigates 16 timeouts when used on 229 real-world smart contract verification tasks.

REMaQE: Reverse Engineering Math Equations from Executables

Cybersecurity attacks on embedded devices for industrial control systems and cyber-physical systems may cause catastrophic physical damage as well as economic loss. This could be achieved by infecting device binaries with malware that modifies the physical characteristics of the system operation. Mitigating such attacks benefits from reverse engineering tools that recover sufficient semantic knowledge in terms of mathematical equations of the implemented algorithm. Conventional reverse engineering tools can decompile binaries to low-level code, but offer little semantic insight. This paper proposes the REMaQE automated framework for reverse engineering of math equations from binary executables. Improving over state-of-the-art, REMaQE handles equation parameters accessed via registers, the stack, global memory, or pointers, and can reverse engineer equations from object-oriented implementations such as C++ classes. Using REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool “tmon”. To evaluate REMaQE, we generate a dataset of 25,096 binaries with math equations implemented in C and Simulink. REMaQE successfully recovers a semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48 seconds on average and in up to 2 seconds for complex equations. Real-time execution enables integration in an interactive math-oriented reverse engineering workflow.

Comparison between an Adaptive Gain Scheduling Control Strategy and a Fuzzy Multimodel Intelligent Control Applied to the Speed Control of Non-Holonomic Robots

The main objective of this work is to address problems related to the speed control of mobile robots with non-holonomic constraints and differential traction—specifically, robots for football games in the VSS (Very Small Size) category. To achieve this objective, an implementation and comparison is carried out between two control strategies: an adaptive control strategy by gain scheduling and a fuzzy multimodel intelligent control strategy. The mathematical models of the wheel motors for each operating range are approximated by a first-order system since data acquisition is performed using the step response. Tuning of the proportional and integral gains of the local controllers is carried out using the root locus technique in discrete time. For each mathematical model obtained for an operating range, a local controller is tuned. Finally, with the local controllers in hand, the implementation of and comparison between the gain scheduling adaptive control strategy and the fuzzy multimodel intelligent control strategy are carried out, in which the control strategies are programmed into the low-level code of a non-holonomic robot with a differential drive to verify the performance of the speed tracking dynamics imposed on the wheel motors to improve robot navigation during a robot football match.

Impaired health in working children: a critical ethnography

Child labor is one of the important social issues that deprive children of many fundamental rights, and make them face many problems and consequences, including health problems. Thus, this study was conducted with the aim of examining the health of working children in Tehran. This is an ethnographic study that was conducted using Carspecken’s approach and was completed in 2022. The main participants of this study included working children aged 10–18 years living in Tehran. In order to collect information, the researcher was present at the workplace, school, and living places of working children for more than two years, observing their lives and activities. Formal and informal interviews were also conducted with the working children and informed people. In total, hundreds of working children were assessed and observed in this research. A friendly conversation was formed between the researcher and more than 50 children, and official interviews were conducted with six of the working children. Also, more than 10 official interviews were conducted with informed people and parents of working children. In addition to observations and interviews, documents such as medical records and drawings of working children were also examined and interpreted. The information obtained from observations, interviews, and documents was entered into MAXQDA software, and its raw codes were extracted. The high-level codes as well as sub and main categories were formed from the aggregation of low-level codes. Impaired health was formed from three subcategories of tormented body (work and environmental trauma, sexual abuse, malnutrition, fatigue, sleep disorder and inadequate hygiene), disquieted mind (anxious children, depression and isolation, reduced self-esteem and unfocused mind) and disrupted sociability (negative social role modeling, aggression and violence, stubbornness and vindictiveness, harassment and nuisance, reprehensible social behaviors, neglecting others’ ownership, disturbed relationships and out-group self-censorship). The results of the present study showed that the health of working children is compromised in various physical, psychological, and social ways. Therefore, some measures should be taken at the national and international levels to improve their health, such as revising the existing laws regarding children and informing children of their rights.

BIT: A template-based approach to incremental and bidirectional model-to-text transformation

Model-driven development is a model-centric software development paradigm that automates the development process by converting high-level models into low-level code and documents. To maintain synchronization between models and code/documents — which can evolve independently — this paper introduces BIT, a bidirectional language that can serve as a conventional template language for model-to-text transformations. However, a BIT program can function as both a printer, generating text by filling template holes with values from the input model, and a parser, putting parsed values back into the model. BIT comprises a surface language for better usability and a core language for formal definition. We define the semantics of the core language based on the theory of bidirectional transformation, and provide the translation from the surface to the core. We present the proof sketch of the well behavedness of BIT as a formal evidence of soundness. We also conduct three case studies to empirically demonstrate the expressiveness and the effectiveness of BIT. Based on the proof and the case studies, BIT covers the major features of existing template languages, and offers sufficient expressiveness to define real-world model-to-text transformations that can be executed bidirectionally and incrementally.

Compiling with Abstract Interpretation

Rewriting and static analyses are mutually beneficial techniques: program transformations change the intensional aspects of the program, and can thus improve analysis precision, while some efficient transformations are enabled by specific knowledge of some program invariants. Despite the strong interaction between these techniques, they are usually considered distinct. In this paper, we demonstrate that we can turn abstract interpreters into compilers, using a simple free algebra over the standard signature of abstract domains. Functor domains correspond to compiler passes, for which soundness is translated to a proof of forward simulation, and completeness to backward simulation. We achieve translation to SSA using an abstract domain with a non-standard SSA signature. Incorporating such an SSA translation to an abstract interpreter improves its precision; in particular we show that an SSA-based non-relational domain is always more precise than a standard non-relational domain for similar time and memory complexity. Moreover, such a domain allows recovering from precision losses that occur when analyzing low-level machine code instead of source code. These results help implement analyses or compilation passes where symbolic and semantic methods simultaneously refine each other, and improves precision when compared to doing the passes in sequence.

A novel code representation for detecting Java code clones using high-level and abstract compiled code representations.

In software development, it's common to reuse existing source code by copying and pasting, resulting in the proliferation of numerous code clones-similar or identical code fragments-that detrimentally affect software quality and maintainability. Although several techniques for code clone detection exist, many encounter challenges in effectively identifying semantic clones due to their inability to extract syntax and semantics information. Fewer techniques leverage low-level source code representations like bytecode or assembly for clone detection. This work introduces a novel code representation for identifying syntactic and semantic clones in Java source code. It integrates high-level features extracted from the Abstract Syntax Tree with low-level features derived from intermediate representations generated by static analysis tools, like the Soot framework. Leveraging this combined representation, fifteen machine-learning models are trained to effectively detect code clones. Evaluation on a large dataset demonstrates the models' efficacy in accurately identifying semantic clones. Among these classifiers, ensemble classifiers, such as the LightGBM classifier, exhibit exceptional accuracy. Linearly combining features enhances the effectiveness of the models compared to multiplication and distance combination techniques. The experimental findings indicate that the proposed method can outperform the current clone detection techniques in detecting semantic clones.

An attentional approach to geometrical illusions.

It is known for a long time that some drawings composed of points, lines, and areas are systematically misperceived. The origin of these geometrical illusions is still unknown. Here we outline how a recent progress in attentional research contributes to a better understanding of such perceptual distortions. The basic idea behind this approach is that crucial elements of a drawing are differently attended. These changes in the allocation of spatial attention go along with systematic changes in low-level spatial coding. As a result, changes in the perception of spatial extent, angles, positions, and shapes can arise. How this approach can be applied to individual illusions is discussed.

Correction: A framework for embedded software portability and verification: from formal models to low-level code

Correction: A framework for embedded software portability and verification: from formal models to low-level code

A framework for embedded software portability and verification: from formal models to low-level code

AbstractPorting software to new target architectures is a common challenge, particularly when dealing with low-level functionality in drivers or OS kernels that interact directly with hardware. Traditionally, adapting code for different hardware platforms has been a manual and error-prone process. However, with the growing demand for dependability and the increasing hardware diversity in systems like the IoT, new software development approaches are essential. This includes rigorous methods for verifying and automatically porting Real-Time Operating Systems (RTOS) to various devices. Our framework addresses this challenge through formal methods and code generation for embedded RTOS. We demonstrate a hardware-specific part of a kernel model in Event-B, ensuring correctness according to the specification. Since hardware details are only added in late modeling stages, we can reuse most of the model and proofs for multiple targets. In a proof of concept, we refine the generic model for two different architectures, also ensuring safety and liveness properties. We then showcase automatic low-level code generation from the model. Finally, a hardware-independent factorial function model illustrates more potential of our approach.

Translation certification for smart contracts

Compiler correctness is an old problem, but with the emergence of smart contracts on blockchains that problem presents itself in a new light. Smart contracts are self-contained pieces of software that control (valuable) assets in an adversarial environment; once committed to the blockchain, these smart contracts cannot be modified. Smart contracts are typically developed in a high-level contract language and compiled to low-level virtual machine code before being committed to the blockchain. For a smart contract user to trust a given piece of low-level code on the blockchain, they must convince themselves that (a) they are in possession of the matching source code and (b) that the compiler has correctly translated the source code to the given low-level code.Classic approaches to compiler correctness tackle the second point. We argue that translation certification also squarely addresses the first. We describe the proof architecture of a translation certification framework and demonstrate how we can model the compilation pipeline as a sequence of translation relations. We give a detailed account of such relations for most passes of the Plutus Tx compiler, which we formalised in Coq. This approach facilitates a modular verification methodology and is robust in the face of an evolving compiler implementation.

Continuing WebAssembly with Effect Handlers

WebAssembly (Wasm) is a low-level portable code format offering near native performance. It is intended as a compilation target for a wide variety of source languages. However, Wasm provides no direct support for non-local control flow features such as async/await, generators/iterators, lightweight threads, first-class continuations, etc. This means that compilers for source languages with such features must ceremoniously transform whole source programs in order to target Wasm. We present WasmFX an extension to Wasm which provides a universal target for non-local control features via effect handlers, enabling compilers to translate such features directly into Wasm. Our extension is minimal and only adds three main instructions for creating, suspending, and resuming continuations. Moreover, our primitive instructions are type-safe providing typed continuations which are well-aligned with the design principles of Wasm whose stacks are typed. We present a formal specification of WasmFX and show that the extension is sound. We have implemented WasmFX as an extension to the Wasm reference interpreter and also built a prototype WasmFX extension for Wasmtime, a production-grade Wasm engine, piggybacking on Wasmtime's existing fibers API. The preliminary performance results for our prototype are encouraging, and we outline future plans to realise a native implementation.

Mutually Iso-Recursive Subtyping

Iso-recursive types are often taken as a type-theoretic model for type recursion as present in many programming languages, e.g., classes in object-oriented languages or algebraic datatypes in functional languages. Their main advantage over an equi-recursive semantics is that they are simpler and algorithmically less expensive, which is an important consideration when the cost of type checking matters, such as for intermediate or low-level code representations, virtual machines, or runtime casts. However, a closer look reveals that iso-recursion cannot, in its standard form, efficiently express essential type system features like mutual recursion or non-uniform recursion. While it has been folklore that mutual recursion and non-uniform type parameterisation can nicely be handled by generalising to higher kinds, this encoding breaks down when combined with subtyping: the classic “Amber” rule for subtyping iso-recursive types is too weak to express mutual recursion without falling back to encodings of quadratic size.We present a foundational core calculus of iso-recursive types withdeclaredsubtyping that can express both inter- and intra-recursion subtyping without such blowup, including subtyping between constructors of higher or mixed kind. In a second step, we identify a syntactic fragment of this general calculus that allows for more efficient type checking without “deep” substitutions, by observing that higher-kinded iso-recursive types can be inserted to “guard” against unwanted β-reductions. This fragment closely resembles the structure of typical nominal subtype systems, but without requiring nominal semantics. It has been used as the basis for a proposed extension of WebAssembly with recursive types.

A framework for flexible and reconfigurable vision inspection systems

Reconfiguration activities remain a significant challenge for automated Vision Inspection Systems (VIS), which are characterized by hardware rigidity and time-consuming software programming tasks. This work contributes to overcoming the current gap in VIS reconfigurability by proposing a novel framework based on the design of Flexible Vision Inspection Systems (FVIS), enabling a Reconfiguration Support System (RSS). FVIS is achieved using reprogrammable hardware components that allow for easy setup based on software commands. The RSS facilitates offline software programming by extracting parameters from real images, Computer-Aided Design (CAD) data, and rendered images using Automatic Feature Recognition (AFR). The RSS offers a user-friendly interface that guides non-expert users through the reconfiguration process for new part types, eliminating the need for low-level coding. The proposed framework has been practically validated during a 4-year collaboration with a global leading automotive half shaft manufacturer. A fully automated FVIS and the related RSS have been designed following the proposed framework and are currently implemented in 7 plants of GKN global automotive supplier, checking 60 defect types on thousands of parts per day, covering more than 200 individual part types and 12 part families.

Entering the Metaverse from the JVM: The State of the Art, Challenges, and Research Areas of JVM-Based Web 3.0 Tools and Libraries

Web 3.0 is the basis on which the proposed metaverse, a seamless virtual world enabled by computers and interconnected devices, hopes to interact with its users, but beyond the high-level project overview of what Web 3.0 applications try to achieve, the implementation is still down to low-level coding details. This article aims to analyze the low-level implementations of key components of Web 3.0 using a variety of frameworks and tools as well as several JVM-based languages. This paper breaks down the low-level implementation of smart contracts and semantic web principles using three frameworks, Corda and Ethereum for smart contracts and Jeda for semantic web, using both Scala and Java as implementing languages all while highlighting differences and similarities between the frameworks used.

Modularity, Code Specialization, and Zero-Cost Abstractions for Program Verification

For all the successes in verifying low-level, efficient, security-critical code, little has been said or studied about the structure, architecture and engineering of such large-scale proof developments. We present the design, implementation and evaluation of a set of language-based techniques that allow the programmer to modularly write and verify code at a high level of abstraction, while retaining control over the compilation process and producing high-quality, zero-overhead, low-level code suitable for integration into mainstream software. We implement our techniques within the F proof assistant, and specifically its shallowly-embedded Low toolchain that compiles to C. Through our evaluation, we establish that our techniques were critical in scaling the popular HACL library past 100,000 lines of verified source code, and brought about significant gains in proof engineer productivity. The exposition of our methodology converges on one final, novel case study: the streaming API, a finicky API that has historically caused many bugs in high-profile software. Using our approach, we manage to capture the streaming semantics in a generic way, and apply it “for free” to over a dozen use-cases. Six of those have made it into the reference implementation of the Python programming language, replacing the previous CVE-ridden code.