Although we know that a known_outcome=1 pilot does not exhibit
behavior different from the golden run, the database schema does not
yet know what this behavior looks like (in terms of result-table
column values). In order to be able to JOIN valid results for all
memory writes in the trace table (fspgroup maps them all onto *one*
pilot per variant), we need to run these experiments, too.
Additionally, don't join the fspgroup table; we only need this one for
result calculations afterwards.
Change-Id: Idcd2991274fede84526b1eee68a231774625d11a
When a register in the extended trace was dereferenced and the value
was smaller than the memory pool size, but the address was not mapped
an assertion occured and the tracing plugin terminated the
simulator. Now the dereferenced memory address is checked for being
mapped and not being smaller than the memory pool.
Change-Id: I9ac954988ef860969679f9f360814c5e4b66f473
During the prune step the data_width of the injected location was not
propagated before. It is now stored in fsppilot (database layout change!) and
sent in the fsppilot protobuf message.
Change-Id: I0562f6fc8957adea0f8a9fb63469ca5e3f4b7b2d
A MemoryImporter that additionally imports Relyzer-style conditional
branch history, instruction opcodes, and a virtual
duration=time2-time1+1 column (MariaDB 5.2+ only) for fault-space
pruning purposes.
Change-Id: I6764a26fa8aae21655be44134b88fdee85e67ff6
This change touches several subsystems, tools and experiments
(sal, util, cmake, import-trace, generic-tracing, nanojpeg), and
changes details not worth separate commits.
Change-Id: Icd1d664d1be5cfc2212dbf77801c271183214d08
This tool can now import extended trace information with the
--extended-trace command-line parameter. The existing importers cease
using artificial access_info_t objects in favor of passing through the
original Trace_Event wherever possible. This allows us to import
extended trace information for all importers.
Change-Id: I3613e9d05d5e69ad49e96f4dc5ba0b1c4ef95a11
It's OK if we cannot map every register LLVM knows to a Fail register
ID, but we need to explicitly skip these cases in the
RegisterImporter.
Change-Id: I2152f819fb94aa4de5720c5798b229b66988d382
This change became necessary as we observed weird fail-client SIGSEGV
crashes with both Bochs and Gem5 backends and different experiments.
Some Fail* components are instantiated statically: the
SimulatorController instance "simulator", containing the
ListenerManager and the CoroutineManager, and the active
ExperimentFlow subclass(es)
(experiments/instantiate-experiment*.ah.in). The experiment(s) is
registered as an active flow in the CoroutineManager at startup.
As plugins (which are ExperimentFlows themselves) are often created on
an experiment's stack, ExperimentFlows deregister themselves on
destruction (e.g., when leaving the plugin variable's scope). The
core problem is, that the creation and destruction order of statically
instantiated objects depends on the link order; if the experiment is
destroyed after the CoroutineManager, its automatic self-deregistering
feature talks to the smoking ruins of the latter.
This change removes all static instantiations of ExperimentFlow and
replaces them with constructions on the heap. Additionally it makes
sure that the CoroutineManager recognizes that a shutdown is in
progress, and refrains from touching potentially already destroyed
data structures when a (mistakenly globally instantiated)
ExperimentFlow deregisters in this case.
Change-Id: I8a7d42fb141222cd2cce6040ab1a01f9de61be24
Contemporary AspectC++ versions can deal with the LLVM headers very
well, and #ifdef __puma stuff in Fail* headers results in
unmaintainable #ifdef __puma blocks in other parts of Fail* (e.g., the
trace importer).
Make sure you're using a 64-bit ac++ when living in a 64-bit userland
(the 32-bit version doesn't know about __int128), and be aware that
AspectC++ r325 introduced a regression that has not been fixed yet.
Change-Id: I5bb759b08995a74b020d44a2b40e9d7a6e18111c
For def/use pruning, the linear address mapping of the x86
sub-registers (e.g., AX represents the lower 16 bits of EAX) must
overlap. If it doesn't, e.g., AX and EAX are considered separate
registers by def/use pruning, resulting in a failure to correlate an
EAX def with a subsequent AX use.
The only user of this mapping up to now, RegisterImporter, forced all
register widths to 8 bits, thereby fortunately canceling out this
problem. Nevertheless it makes no sense to continue encoding a
constant width in these virtual addresses.
Existing trace, fspgroup, fsppilot and result tables may be converted
to the new encoding by using this query:
UPDATE <tablename> SET data_address = ((data_address >> 4) & ~0xf) | data_address & 0xf;
Change-Id: I7a942b78c34f6140803a86af639eeedef3550f34
This change adapts the gem5 backend to the Register class interface change
in commit 52723a8. The necessary modifications suggested adding the "misc"
registers from gem5, too.
Change-Id: I32561c3fc905b9cd396e32ce80c791c01d5682fb
The extended trace register list is needed in multiple locations; the CPU
class is the logical module to contain this information.
Increased number of x86 registers to be traced; we can remove those
that prove unusable for fault-space pruning later on.
Change-Id: Ic46ecdbc55167a6d92872c190317fc0d1a3ad92d
This allows a register to be a member of multiple UniformRegisterSets.
Needed to architecture-specifically store, e.g., a list of registers to
record in traces.
Change-Id: Ia5d20768540efe252a84df967d43e569f107da3a
Several database implementations, including, e.g., MySQL and PostgreSQL,
allow multiple rows to be INSERTed at once. At least for MySQL this
improves INSERT speed significantly.
Change-Id: Ic223f7915053f30b0cb00c567310f3e780c9fa59
Database::insert_id() retrieves the auto-generated ID from the last INSERT
or UPDATE on a table containing an AUTO_INCREMENT column.
Change-Id: I6ec94d1820bb7e77bd37df33145caa93016fd328
The SConscript in src/core/sal/gem5 is now generated via CMake
(SConscript.in). No more hardcoded relative paths -> Fail* build
folder can now be anywhere. Experiment and Plugin libraries are now
set automagically (using ${EXPERIMENTS_ACTIVATED} /
${PLUGINS_ACTIVATED})
Generated SConscript now resides in binary dir.
Change-Id: I1bf2e17c83c95ffdcf6801c02481064fcb63bfb0
This commit introduces a virtual dtor in the ArmCPUState class to
prevent the compiler from producing the following warning:
"deleting object of polymorphic class type 'fail::Gem5ArmCPU' which
has non-virtual destructor might cause undefined behaviour"
Change-Id: I5029662064e72ae87a9f0e36aeaa309e4cb2291b
The InstructionImporter does disassemble the binary and generate read
traces for every instruction byte executed.
Change-Id: I6b8697c711c009e106ed733c74c6ff8f9bbf8ac5
The variant/benchmark selection now can use SQL LIKE syntax, all unfinished
pilots from all selected variants are sent to the clients. E.g.:
./cored-voter-server -v x86-cored-voter -b simple-% -p basic
Will select the fsppilots in the variants:
- x86-cored-voter/simple-ip/basic
- x86-cored-voter/simple-instr/basic
The variant and benchmark information is now sent within the
fsppilot.
Change-Id: I287bfcddc478d0b79d89e156d6f5bf8188674532
The LLVM Disassembler infrastructure can be used to analyze many kinds
of ELF Binaries. For every instruction the used and defined registers
is available as well as information about the instruction itself.
Change-Id: I9cc89b6c116ceff7b5143a6f179ae31c4e994d2d
The build system now allows incremental gem5 builds. Unfortunately,
the current solution always requires re-linking the executable.
Without the enforcement of re-linking, the fail code will be rebuilt
but not linked into gem5.
The number of cores for building gem5 is derived from /proc/cpuinfo.
As before, only the gem5.debug configuration is supported.
Change-Id: Ib13b15d1ecd62196eb251e0fd00953f4eb052feb
This does enable % patterns in variant and benchmark selections, like
it is already implemented in the prune-tool.
Change-Id: I7497bfd588d6ffdf851d767bafc660f4872ae92f
The correct flags accessor methods should be used to write the flags register,
since values (especially the arithmetic flags) might be cached.
Change-Id: I338927cfdd1f111966be539668914c9256b54c8f
The client sends results back earlier (i.e., before all jobs are
done) if the client response time (CLIENT_JOB_REQUEST_SEC) is
exceeded. This makes sure that extraordinarily long-running
experiments get reported back before, e.g., the LIDO job timeout
kills the Fail* instance.
Change-Id: I3ada0360ec54b63f80a7008570ca514449720220
It is no longer required (and recommended) to write a dependency
check (using conditional compilation) in the experiment code. Instead,
the Fail code performs these checks itself. If an experiment is
compiled without having the required configuration flags set to
enabled, the compiler emits an error. This is because the constructors
of unused listener classes are declared as protected. (Note that
this works only because the Fail code does not create any listeners.)
In a next step, one should remove all the dependency guards in the
existing experiments (not needed anymore).
Change-Id: I1331813a432a752322d510b4102da53ff53294f0
Quoting connect(3posix): "If connect() fails, the state of the socket is
unspecified. Conforming applications should close the file descriptor and
create a new socket before attempting to reconnect."
Change-Id: Ibcdcc0f546560a41009832894659a37947243f2f
The previous fault injection experiment was kind of bullshit. This one
is better in several ways:
- sanity check at injection time (correct IP)
- correct counting of kernel_transistions
- copy whole activation scheme
Change-Id: I014eea4d6fe103bc02ffd7bbca95dc56a1a4d9ea
Is now very similar to normal importer, and may be deleted in the future, but
at the moment, this should be merged, since it is the importer used in the
sobres-2013 paper.
This changes the MySQL Schema. instr1_absolute was introduced.
Change-Id: I1bc2919bd14c335beca6d586b7cc0f80767ad7d5
Doxygen skips undesired directories and files now. In addition, the
documentation of the "fail" namespace has been fixed. Note that there
are still several warnings (due to incomplete documentations) in the
Doxygen output.
Change-Id: Idad4f1ecff453765b307fa40a5c1cebc0c2ce2bb
The checkpoint which is produced by this save method is a little bit
different to the checkpoint which is produced by the --take-checkpoint
command. It differs in the save-parameters so_state, funcExeInst, intRegs,
_upc, _nupc, _when. Tests have shown that it probably does not affect the
course of the program execution.
Change-Id: Id776a10f2d40f71643e9edbb45d7368609309df4
