christoph/fail
1
Fork 0
Code Releases Activity

Minimal VEZS example experiment

Browse Source 
git-svn-id: https://www4.informatik.uni-erlangen.de/i4svn/danceos/trunk/devel/fail@1440 8c4709b5-6ec9-48aa-a5cd-a96041d1645a
This commit is contained in:
hoffmann
2012-07-06 10:41:13 +00:00
parent 13d5e4dbeb
commit 4aa4943ae9
3 changed files with 42 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
src/experiments/vezs-example/experiment.cc
View File

@ -25,63 +25,56 @@ using namespace fail;
#error This experiment needs: breakpoints, traps, save, and restore. Enable these in the configuration.
#endif
bool ChecksumOOStuBSExperiment::run()
bool VEZSExperiment::run()
{
Logger log("VEZS-Example", false);
BPSingleEvent bp;
log << "startup" << endl;
BPSingleEvent bp;
#if 1
// STEP 1: run until interesting function starts, and save state
bp.setWatchInstructionPointer(OOSTUBS_FUNC_ENTRY);
simulator.addEventAndWait(&bp);
log << "test function entry reached, saving state" << endl;
log << "EIP = " << hex << bp.getTriggerInstructionPointer() << " or " << simulator.getRegisterManager().getInstructionPointer() << endl;
simulator.save("vezs.state");
#endif
#if 0
bp.setWatchInstructionPointer(ANY_ADDR);
bp.setCounter(OOSTUBS_NUMINSTR);
int bit_offset = 2;
for (int instr_offset = 0; instr_offset < OOSTUBS_NUMINSTR; ++instr_offset) {
//simulator.addEvent(&bp);
// BPSingleEvent ev_count(ANY_ADDR);
// simulator.addEvent(&ev_count);
// STEP 3: The actual experiment.
log << "restoring state" << endl;
simulator.restore("vezs.state");
for (int i = 0; i < 400; ++i) { // more than 400 will be very slow (500 is max)
// XXX debug
int instr_offset = 1000;
// reaching finish() could happen before OR after FI
BPSingleEvent func_finish(OOSTUBS_FUNC_FINISH);
simulator.addEvent(&func_finish);
bool finish_reached = false;
log << "EIP = " << hex << simulator.getRegisterManager().getInstructionPointer() << endl;
bp.setWatchInstructionPointer(ANY_ADDR);
bp.setCounter(instr_offset);
simulator.addEvent(&bp);
// finish() before FI?
if (simulator.waitAny() == &func_finish) {
finish_reached = true;
log << "experiment reached finish() before FI" << endl;
// wait for bp
simulator.waitAny();
for (int count = 0; count < instr_offset; ++count) {
simulator.addEventAndWait(&bp);
}
// --- fault injection ---
//byte_t newdata = data ^ (1 << bit_offset);
//mm.setByte(mem_addr, newdata);
// note at what IP we did it
int32_t data = simulator.getRegisterManager().getRegister(RID_CAX)->getData();
// The INJECTION:
int32_t newdata = data ^ (1<<bit_offset);
simulator.getRegisterManager().getRegister(RID_CAX)->setData(newdata);
int32_t injection_ip = simulator.getRegisterManager().getInstructionPointer();
log << "fault injected @ ip " << injection_ip << endl;
log << "inject @ ip " << injection_ip
<< " (offset " << dec << instr_offset << ")"
<< " bit " << bit_offset << ": 0x"
<< hex << ((int)data) << " -> 0x" << ((int)newdata) << endl;
// --- aftermath ---
// possible outcomes:
// - trap, "crash"
// - jump outside text segment
// - (XXX unaligned jump inside text segment)
// - (XXX weird instructions?)
// - (XXX results displayed?)
// - reaches THE END
// - error detected, stop
// additional info:
// - #loop iterations before/after FI
// - (XXX "sane" display?)
// catch traps as "extraordinary" ending
TrapEvent ev_trap(ANY_TRAP);
@ -98,23 +91,14 @@ bool ChecksumOOStuBSExperiment::run()
// remaining instructions until "normal" ending
BPSingleEvent ev_end(ANY_ADDR);
ev_end.setCounter(OOSTUBS_NUMINSTR + OOSTUBS_RECOVERYINSTR - instr_offset);
ev_end.setCounter(OOSTUBS_NUMINSTR - instr_offset);
simulator.addEvent(&ev_end);
// Start simulator and wait for any result
BaseEvent* ev = simulator.waitAny();
// Do we reach finish() while waiting for ev_trap/ev_done?
if (ev == &func_finish) {
finish_reached = true;
log << "experiment reached finish()" << endl;
// wait for ev_trap/ev_done
ev = simulator.waitAny();
}
// record latest IP regardless of result
//simulator.getRegisterManager().getInstructionPointer();
injection_ip = simulator.getRegisterManager().getInstructionPointer();
if (ev == &ev_end) {
@ -128,11 +112,13 @@ bool ChecksumOOStuBSExperiment::run()
} else {
log << "Result WTF?" << endl;
}
log << "@ ip 0x" << hex << injection_ip << endl;
// explicitly remove all events before we leave their scope
// FIXME event destructors should remove them from the queues
simulator.clearEvents();
}
}
#endif
// Explicitly terminate, or the simulator will continue to run.
simulator.terminate();
}

4
src/experiments/vezs-example/experiment.hpp
View File

@ -4,10 +4,10 @@
#include "efw/ExperimentFlow.hpp"
#include "efw/JobClient.hpp"
class ChecksumOOStuBSExperiment : public fail::ExperimentFlow {
class VEZSExperiment : public fail::ExperimentFlow {
fail::JobClient m_jc;
public:
ChecksumOOStuBSExperiment() : m_jc("ios.cs.tu-dortmund.de") {}
VEZSExperiment() : m_jc("ios.cs.tu-dortmund.de") {}
bool run();
};

34
src/experiments/vezs-example/experimentInfo.hpp
View File

@ -3,48 +3,22 @@
// FIXME autogenerate this
#if 1 // with ECC
// the task function's entry address:
// nm -C ecc.elf|fgrep main
#define OOSTUBS_FUNC_ENTRY 0x00101eaa
#define OOSTUBS_FUNC_ENTRY 0x001009d0
// empty function that is called explicitly when the experiment finished
// nm -C ecc.elf|fgrep "finished()"
#define OOSTUBS_FUNC_FINISH 0x00106da4
#define OOSTUBS_FUNC_FINISH 0x001009d6
// function executing HLT with no chance for further progress (after panic())
// nm -C ecc.elf|fgrep cpu_halt
#define OOSTUBS_FUNC_CPU_HALT 0x001009f7
// nm -C ecc.elf | fgrep "_TEXT_"
#define OOSTUBS_TEXT_START 0x00100000
#define OOSTUBS_TEXT_END 0x00107cbf
#define OOSTUBS_TEXT_END 0x00100a1b
// number of instructions the target executes under non-error conditions from ENTRY to DONE:
// (result of experiment's step #2)
#define OOSTUBS_NUMINSTR 0x4B16E6
// number of instructions that are executed additionally for error corrections
// (this is a rough guess ... TODO)
#define OOSTUBS_RECOVERYINSTR 0x2000
// the variable that's increased if ECC corrects an error:
// nm -C ecc.elf|fgrep errors_corrected
#define OOSTUBS_ERROR_CORRECTED 0x0010baf0
//
// nm -C ecc.elf|fgrep results
#define OOSTUBS_RESULTS_ADDR 0x0010ae6c
#define OOSTUBS_RESULTS_BYTES 12
#define OOSTUBS_RESULT0 0xab3566a9
#define OOSTUBS_RESULT1 0x44889112
#define OOSTUBS_RESULT2 0x10420844
#define OOSTUBS_NUMINSTR 5
#else // without ECC
#define COOL_ECC_FUNC_ENTRY 0x00200a90
#define COOL_ECC_CALCDONE 0x00200ab7
#define COOL_ECC_NUMINSTR 97
#define COOL_ECC_OBJUNDERTEST 0x0021263c
#define COOL_ECC_OBJUNDERTEST_SIZE 10
#define COOL_ECC_ERROR_CORRECTED 0x002127b0 // dummy
#endif
#endif // __EXPERIMENT_INFO_HPP__