Architecture | Mahbub H. Raton

AEGIS: An LLVM Pass for Hardware Reliability

Fri, 01 Aug 2025 00:00:00 +0000

Transient hardware faults — a bit flipped in a cache line or a register by a stray particle or a marginal voltage — do not announce themselves. The machine keeps running and quietly produces the wrong answer. AEGIS is an LLVM pass that makes a program check its own arithmetic, so that a corrupted value is caught before it can escape.

The pass implements Error Detection by Duplicated Instructions (EDDI). It duplicates global, stack, and heap values and compares the two copies at the points where a wrong value would become observable: before a store, before a branch, and before a function call. Getting this to work on real programs meant more than duplicating instructions:

Call boundaries. Call sites are rewritten to pass shadow arguments and retrieve shadow return values, so duplication survives across function calls rather than stopping at each one.
Pointer sizes. Knowing how much memory to duplicate behind a pointer is not something the IR tells you. The pass recovers it from DWARF debug metadata, falling back to a signature table for library calls.
Extensibility. Hardening schemes are registered through a strategy registry, so adding a new one is a single self-registering file rather than an edit threaded through the pass.
Testing. A regression suite validates both that the transformation is correct and that fault-detection coverage holds across the benchmark suite.

Measured against L1 cache fault injection, AEGIS reduces silent data corruption by 1.3× to 29× across qsort, matmul, and CRC32, at a runtime cost of 1.6× to 3.0×.

Built with C++, LLVM, Clang, and CMake.

Architectural Fault Injection Framework

Fri, 01 Aug 2025 00:00:00 +0000

You cannot argue about how much a reliability technique helps without measuring how often things actually go wrong. This framework extends the gem5 simulator to inject faults into the register file and the L1 cache, and pinpoints the first instruction that reads corrupted data — at under 0.1% simulation overhead.

The harder half of the problem is statistical. A single injection tells you nothing; useful confidence intervals need hundreds of thousands of runs. The Python automation layer around gem5 makes that tractable:

Checkpointing and parallelism. Simulations resume from gem5 checkpoints and are distributed across multiple machines. A 600,000-injection campaign across three benchmarks went from 7 days to under 24 hours.
Outcome classification. Each run is automatically classified as silent data corruption, masked, detected, crash, or timeout, and reported with 99% confidence margins.
Root-cause analysis. When an injection produces a wrong result, the harness diffs execution traces to find where the corrupted value first diverged.

This is the measurement apparatus behind the AEGIS numbers.

Built with C++, Python, gem5, Docker, and Linux.

Cross-Compiling x86 Binaries to ARM

Sat, 01 Jun 2024 00:00:00 +0000

Moving a program to a new instruction set architecture is straightforward when you have the source. When you do not, you have to reconstruct enough of the program’s meaning from the binary itself to emit correct code for a different machine.

This project extended Binrec — a dynamic binary lifting framework that recovers LLVM IR by observing concrete executions — to target AArch64 from x86 input. The work centered on two things:

Adapting the lifting pipeline. Binrec’s dynamic execution and IR recovery stages assumed an x86 target throughout; retargeting them meant separating what was genuinely architecture-neutral in the recovered IR from what had quietly encoded x86 assumptions.
A translation layer for library calls. Calls out to the C library cross the boundary where the two calling conventions disagree. An x64-to-AArch64 shim translates arguments and return values at that boundary.

The result runs two real-world SPEC CPU 2017 programs, mcf and xalancbmk, correctly on ARM, at roughly 6× slowdown relative to native.

A manuscript on the architectural mismatches this work surfaced is in preparation.

Built with LLVM, C++, S2E, and x86/ARM assembly.

MIPS 4 Bit Processor Design

Mon, 21 Dec 2020 13:15:46 +0000

A MIPS processor that can do 4-bit operations. This processor was designed to do these 12 operations:

Addition(add)
Subtraction(sub)
Add immediate(addi)
Subtract immediate(subi)
Logical OR(or)
OR immediate(ori)
Logical AND(and)
AND immediate(ori)
Branch Equal(beq)
Jump(j)
Load from memory(lw)
Store into memory(sw)

The design was implemented and validated in logisim simulator. The ciruite design file along with a sample instruction file can be found in the code repository.