Waste inspection for packaged waste is an important step in the pipeline of waste disposal. Previous methods either rely on manual visual checking or RGB image-based inspection algorithm, requiring costly preparation procedures (e.g., open the bag and spread the waste items). Moreover, occluded items are very likely to be left out. Inspired by the fact that X-ray has a strong penetrating power to see through the bag and overlapping objects, we propose to perform waste inspection efficiently using X-ray images without the need to open the bag. We introduce a novel problem of instance-level waste segmentation in X-ray image for intelligent waste inspection, and contribute a real dataset consisting of 5,038 X-ray images (totally 30,881 waste items) with high-quality annotations (i.e., waste categories, object boxes, and instance-level masks) as a benchmark for this problem. As existing segmentation methods are mainly designed for natural images and cannot take advantage of the characteristics of X-ray waste images (e.g., heavy occlusions and penetration effect), we propose a new instance segmentation method to explicitly take these image characteristics into account. Specifically, our method adopts an easy-to-hard disassembling strategy to use high confidence predictions to guide the segmentation of highly overlapped objects, and a global structure guidance module to better capture the complex contour information caused by the penetration effect. Extensive experiments demonstrate the effectiveness of the proposed method. Our dataset is released at WIXRayNet.

Container technology has been used for running multiple isolated operating system distros on a host or deploying large scale microservice-based applications. In most cases, containers share the same kernel with the host and other containers on the same host, and the application in the container can make system calls of the host kernel like a normal process on the host. Seccomp is a security mechanism for the Linux kernel, through which we can prohibit certain system calls from being executed by the program. Docker began to support the seccomp mechanism from version 1.10 and disables around 44 system calls out of 300+ by default. However, for a particular container, there are still many system calls that are unnecessary for running it allowed to be executed, and the abuse of system calls by a compromised container can trigger the security vulnerabilities of a host kernel. Unfortunately, Docker does not provide a way to get the necessary system calls for a particular container. In this paper, we propose RSDS, a method combining dynamic analysis and static analysis to get the necessary system calls for a particular container. Our experiments show that our solution can reduce system calls by 69.27%-85.89% compared to the default configuration on an x86-64 PC with Ubuntu 16.04 host OS and does not affect the functionalities of these containers.

In Speculative Multithreading, data dependence that limits the speedup of speculative parallelization needs to be resolved to achieve a high performance. This paper designs a synchronization execution model, with the support of compiler, to synchronize store and load instructions that frequently have data dependence on each other. We use hardware profiler to gather dependence violation information of memory data, and the profiler information is fed back to the compiler. The compiler analyzes the synchronization efficiency, select store/load pairs of great synchronization potential, and inserts synchronization instructions using insertion algorithm. Loop threads and non-loop threads can both be synchronized. The hardware support is also given in the paper. The experimental results show that the synchronization under the compiler support can effectively resolve some memory data dependence and improve the performance of the speculative execution.

In the paper, we investigate the memory access technology on cell broadband engine architecture (CBEA), and develop a profiling infrastructure for memory management on the architecture. By registering the dynamic memory allocation and providing details of trace of memory access, the infrastructure provides the data partition information automatically which alleviates the burdens of programmer and provides a safety guarantee for aggressive data prefetch for computing task. On the other hand, the profile information is useful for analyzing the patterns of memory access and helpful for further performance optimization. Experimental results show that applications implemented based on our SDK library not only support aggressive memory access method without the requirement of external data partition information, but also could be optimized aggressively under the guideline of the profile information provided by the proposed SDK library.