christoph/fail
1
Fork 0
Code Actions Packages Releases Activity

experiments/kesorefs: convert to DatabaseCampaign

Browse Source 
Change-Id: I7607911c28ffb2427681db241ac721f1ae2c002a
This commit is contained in:
Christian Dietrich
2013-04-24 07:50:28 +02:00
parent 2753a165ba
commit 923ba362fa
6 changed files with 213 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/experiments/kesorefs/CMakeLists.txt
View File

@ -30,5 +30,5 @@ target_link_libraries(fail-${EXPERIMENT_NAME} ${PROTOBUF_LIBRARY})
## This is the example's campaign server distributing experiment parameters ## This is the example's campaign server distributing experiment parameters
add_executable(${EXPERIMENT_NAME}-server main.cc) add_executable(${EXPERIMENT_NAME}-server main.cc)
target_link_libraries(${EXPERIMENT_NAME}-server fail-${EXPERIMENT_NAME} fail ${PROTOBUF_LIBRARY} ${Boost_THREAD_LIBRARY}) target_link_libraries(${EXPERIMENT_NAME}-server -Wl,--start-group fail-${EXPERIMENT_NAME} fail-sal fail-util fail-cpn fail-comm ${PROTOBUF_LIBRARY} ${Boost_THREAD_LIBRARY} -lmysqlclient -Wl,--end-group)
install(TARGETS ${EXPERIMENT_NAME}-server RUNTIME DESTINATION bin) install(TARGETS ${EXPERIMENT_NAME}-server RUNTIME DESTINATION bin)

74
src/experiments/kesorefs/campaign.cc
View File

@ -5,80 +5,16 @@
#include "experimentInfo.hpp" #include "experimentInfo.hpp"
#include "cpn/CampaignManager.hpp" #include "cpn/CampaignManager.hpp"
#include "util/Logger.hpp" #include "util/Logger.hpp"
#include "util/ElfReader.hpp"
#include "util/ProtoStream.hpp" #include "util/ProtoStream.hpp"
#include "sal/SALConfig.hpp" #include "sal/SALConfig.hpp"
//#if COOL_FAULTSPACE_PRUNING
//#include "../plugins/tracing/TracingPlugin.hpp"
//char const * const trace_filename = "trace.pb";
//#endif
using namespace std; using namespace std;
using namespace fail; using namespace fail;
using namespace google::protobuf;
char const * const results_csv = "kesorefs.csv"; void KesoRefCampaign::cb_send_pilot(DatabaseCampaignMessage pilot) {
KesoRefExperimentData *data = new KesoRefExperimentData;
bool KesoRefCampaign::run() data->msg.mutable_fsppilot()->CopyFrom(pilot);
{ campaignmanager.addParam(data);
Logger log("KesoRefCampaign");
ElfReader elf;
ifstream test(results_csv);
if (test.is_open()) {
log << results_csv << " already exists" << endl;
return false;
}
ofstream results(results_csv);
if (!results.is_open()) {
log << "failed to open " << results_csv << endl;
return false;
}
address_t injip = elf.getSymbol("c23_PersistentDetectorScopeEntry_m5_run").getAddress();
address_t rambase = elf.getSymbol("__CIAO_APPDATA_cdx_det__heap").getAddress();
// address_t ramend = rambase + 0x80000;
address_t ramend = rambase + 4;
cout << "ramend: " << hex << ramend << endl;
log << "startup, injecting ram @ " << hex << rambase << endl;
int count = 0;
for (address_t ram_address = rambase; ram_address < ramend ; ram_address += 4) {
for (int bit_offset = 23; bit_offset < 24; ++bit_offset) {
KesoRefExperimentData *d = new KesoRefExperimentData;
d->msg.set_pc_address(injip);
d->msg.set_ram_address(ram_address);
d->msg.set_bit_offset(bit_offset);
campaignmanager.addParam(d);
++count;
}
}
campaignmanager.noMoreParameters();
log << "done enqueueing parameter sets (" << dec << count << ")." << endl;
// collect results
KesoRefExperimentData *res;
int rescount = 0;
results << "injection_ip\tram_address\tbit_offset\tresulttype\toriginal_value\tdetails" << endl;
while ((res = static_cast<KesoRefExperimentData *>(campaignmanager.getDone()))) {
rescount++;
results
<< "0x" << hex << res->msg.pc_address() << "\t"
<< "0x" << hex << res->msg.ram_address() << "\t"
<< dec << res->msg.bit_offset() << "\t"
<< res->msg.resulttype() << "\t"
<< res->msg.original_value() << "\t"
<< res->msg.details() << "\n";
delete res;
}
log << "done. sent " << count << " received " << rescount << endl;
results.close();
return true;
} }

13
src/experiments/kesorefs/campaign.hpp
View File

@ -1,19 +1,24 @@
#ifndef __KESOREFCAMPAIGN_HPP__ #ifndef __KESOREFCAMPAIGN_HPP__
#define __KESOREFCAMPAIGN_HPP__ #define __KESOREFCAMPAIGN_HPP__
#include "cpn/Campaign.hpp" #include "cpn/DatabaseCampaign.hpp"
#include "comm/ExperimentData.hpp" #include "comm/ExperimentData.hpp"
#include <google/protobuf/descriptor.h>
#include "kesoref.pb.h" #include "kesoref.pb.h"
class KesoRefExperimentData : public fail::ExperimentData { class KesoRefExperimentData : public fail::ExperimentData {
public: public:
KesoRefProtoMsg msg; KesoRefProtoMsg msg;
KesoRefExperimentData() : fail::ExperimentData(&msg) {} KesoRefExperimentData() : fail::ExperimentData(&msg) {}
}; };
class KesoRefCampaign : public fail::Campaign {
public: class KesoRefCampaign : public fail::DatabaseCampaign {
virtual bool run(); virtual const google::protobuf::Descriptor * cb_result_message()
{ return google::protobuf::DescriptorPool::generated_pool()->FindMessageTypeByName("KesoRefProtoMsg"); }
virtual void cb_send_pilot(DatabaseCampaignMessage pilot);
}; };
#endif // __KESOREFCAMPAIGN_HPP__ #endif // __KESOREFCAMPAIGN_HPP__

281
src/experiments/kesorefs/experiment.cc
View File

@ -28,9 +28,8 @@ using namespace fail;
#define SAFESTATE (1) #define SAFESTATE (1)
// Check if configuration dependencies are satisfied: // Check if configuration dependencies are satisfied:
#if !defined(CONFIG_EVENT_BREAKPOINTS) || !defined(CONFIG_SR_RESTORE) || \ #if !defined(CONFIG_EVENT_BREAKPOINTS) || !defined(CONFIG_SR_RESTORE)
!defined(CONFIG_SR_SAVE) #error This experiment needs: breakpoints, traps, save, and restore. Enable these in the configuration.
#error This experiment needs: breakpoints, traps, save, and restore. Enable these in the configuration.
#endif #endif
// //
//void KESOrefs::printEIP() { //void KESOrefs::printEIP() {
@ -39,27 +38,28 @@ using namespace fail;
unsigned KESOrefs::injectBitFlip(address_t data_address, unsigned bitpos){ unsigned KESOrefs::injectBitFlip(address_t data_address, unsigned bitpos){
MemoryManager& mm = simulator.getMemoryManager(); MemoryManager& mm = simulator.getMemoryManager();
unsigned value, injectedval; unsigned int value, injectedval;
mm.getBytes(data_address, 4, (void*)&value); value = mm.getByte(data_address);
injectedval = value ^ (1<<bitpos); injectedval = value ^ (1 << bitpos);
mm.setBytes(data_address, 4, (void*)&injectedval); mm.setByte(data_address, injectedval);
m_log << "INJECTION at: 0x" << hex << setw(8) << setfill('0') << data_address; m_log << "INJECTION at: 0x" << hex << setw(2) << setfill('0') << data_address
cout << " value: 0x" << setw(8) << setfill('0') << value << " -> 0x" << setw(8) << setfill('0') << injectedval << endl; << " value: 0x" << setw(2) << setfill('0') << value << " -> 0x" << setw(2) << setfill('0') << injectedval << endl;
return value; return value;
} }
void handleEvent(KesoRefExperimentData& param, KesoRefProtoMsg_ResultType restype, const std::string &msg){ void handleEvent(KesoRefProtoMsg_Result& result, KesoRefProtoMsg_Result_ResultType restype, const std::string &msg) {
cout << msg << endl; cout << msg << endl;
param.msg.set_resulttype(restype); result.set_resulttype(restype);
param.msg.set_details(msg); result.set_details(msg);
} }
void handleMemoryAccessEvent(KesoRefExperimentData& param, const fail::MemAccessListener& l_mem){
void handleMemoryAccessEvent(KesoRefProtoMsg_Result& result, const fail::MemAccessListener& l_mem){
stringstream sstr; stringstream sstr;
sstr << "mem access ("; sstr << "mem access (";
switch (l_mem.getTriggerAccessType()) { switch (l_mem.getTriggerAccessType()) {
@ -75,128 +75,187 @@ void handleMemoryAccessEvent(KesoRefExperimentData& param, const fail::MemAccess
sstr << " ip @ 0x" << hex << l_mem.getTriggerInstructionPointer(); sstr << " ip @ 0x" << hex << l_mem.getTriggerInstructionPointer();
handleEvent(param, param.msg.MEMACCESS, sstr.str()); handleEvent(result, result.MEMACCESS, sstr.str());
} }
bool KESOrefs::run() bool KESOrefs::run()
{ {
m_dis.init(); address_t minimal_ip = INT_MAX; // 1 Mbyte
//******* Boot, and store state *******// address_t maximal_ip = 0;
m_log << "STARTING EXPERIMENT" << endl; address_t minimal_data = 0x100000; // 1 Mbyte
#if SAFESTATE // define SS (SafeState) when building: make -DSS address_t maximal_data = 0;
#warning "Building safe state variant"
m_log << "Booting, and saving state at main" << std::endl;
// m_elf.printSections();
// m_elf.printDemangled();
simulator.terminate(); for (ElfReader::section_iterator it = m_elf.sec_begin();
BPSingleListener bp; it != m_elf.sec_end(); ++it) {
// STEP 1: run until interesting function starts, and save state const ElfSymbol &symbol = *it;
bp.setWatchInstructionPointer(m_elf.getSymbol("main").getAddress()); std::string prefix(".text");
if(simulator.addListenerAndResume(&bp) == &bp){ if (symbol.getName().compare(0, prefix.size(), prefix) == 0) {
m_log << "main function entry reached, saving state" << endl; minimal_ip = std::min(minimal_ip, symbol.getStart());
} maximal_ip = std::max(maximal_ip, symbol.getEnd());
} else {
minimal_data = std::min(minimal_data, symbol.getStart());
maximal_data = std::max(maximal_data, symbol.getEnd());
}
}
simulator.save("keso.state"); std::cout << "Code section from " << hex << minimal_ip << " to " << maximal_ip << std::endl;
simulator.terminate(); std::cout << "Whole programm section from " << hex << minimal_data << " to " << maximal_data << std::endl;
#else
//******* Fault injection *******//
#warning "Building restore state variant"
for (int experiment_count = 0; experiment_count < 200 || (m_jc.getNumberOfUndoneJobs() != 0) ; ) { // only do 200 sequential experiments, to prevent swapping
m_log << "asking jobserver for parameters" << endl; // m_dis.init();
KesoRefExperimentData param; //******* Boot, and store state *******//
if(!m_jc.getParam(param)){ m_log << "STARTING EXPERIMENT" << endl;
m_log << "Dying." << endl; // We were told to die.
simulator.terminate(1);
}
// Get input data from Jobserver unsigned executed_jobs = 0;
address_t injectionPC = param.msg.pc_address();
address_t data_address = param.msg.ram_address();
unsigned bitpos = param.msg.bit_offset();
simulator.restore("keso.state"); // Setup exit points
// Goto injection point const ElfSymbol &s_error = m_elf.getSymbol("keso_throw_error");
BPSingleListener injBP; BPSingleListener l_error(s_error.getAddress());
m_log << "Trying to inject @ " << hex << m_elf.getSymbol(injectionPC).getAddress() << endl; const ElfSymbol &s_nullp = m_elf.getSymbol("keso_throw_nullpointer");
BPSingleListener l_nullp(s_nullp.getAddress());
const ElfSymbol &s_parity = m_elf.getSymbol("keso_throw_parity");
BPSingleListener l_parity(s_parity.getAddress());
const ElfSymbol &s_oobounds = m_elf.getSymbol("keso_throw_index_out_of_bounds");
BPSingleListener l_oobounds(s_oobounds.getAddress());
BPSingleListener l_dump(m_elf.getSymbol("c17_Main_m4_dumpResults_console").getAddress());
injBP.setWatchInstructionPointer(injectionPC); MemAccessListener l_mem_text(minimal_ip, MemAccessEvent::MEM_WRITE);
l_mem_text.setWatchWidth(maximal_ip - minimal_ip);
simulator.addListenerAndResume(&injBP); MemAccessListener l_mem_outerspace( maximal_data);
/// INJECT BITFLIP: l_mem_outerspace.setWatchWidth(0xfffffff0);
param.msg.set_original_value(injectBitFlip(data_address, bitpos)); TrapListener l_trap(ANY_TRAP);
// Setup exit points TimerListener l_timeout(1000 * 1000); // 1 second in microseconds
BPSingleListener l_error(m_elf.getSymbol("keso_throw_error").getAddress());
BPSingleListener l_nullp(m_elf.getSymbol("keso_throw_nullpointer").getAddress());
BPSingleListener l_parity(m_elf.getSymbol("keso_throw_parity").getAddress());
BPSingleListener l_oobounds(m_elf.getSymbol("keso_throw_index_out_of_bounds").getAddress());
BPSingleListener l_dump(m_elf.getSymbol("c17_Main_m4_dumpResults_console").getAddress());
ElfSymbol sym = m_elf.getSection(".text"); while (executed_jobs < 25 || m_jc.getNumberOfUndoneJobs() > 0) {
MemAccessListener l_mem_text(sym.getStart(), , AccessEvent::MEM_WRITE); l_mem_text.setWatchWidth(sym.getSize()); m_log << "asking jobserver for parameters" << endl;
KesoRefExperimentData param;
if(!m_jc.getParam(param)){
m_log << "Dying." << endl; // We were told to die.
simulator.terminate(1);
}
sym = m_elf.getSection(".text.cdx_det"); // Get input data from Jobserver
MemAccessListener l_mem_textcdx_det(sym.getStart(), MemAccessEvent::MEM_WRITE ); l_mem_textcdx_det.setWatchWidth(sym.getSize()); unsigned injection_instr = param.msg.fsppilot().injection_instr();
address_t data_address = param.msg.fsppilot().data_address();
sym = m_elf.getSection(".copy_sec"); for (int bit_offset = 0; bit_offset < 8; ++bit_offset) {
MemAccessListener l_mem_outerspace( sym.getStart() ); l_mem_outerspace.setWatchWidth(0xfffffff0); // 8 results in one job
TrapListener l_trap(ANY_TRAP); KesoRefProtoMsg_Result *result = param.msg.add_result();
result->set_bitoffset(bit_offset);
cout << " outerspace : " << l_mem_outerspace.getWatchWidth() << " --- @ :" << l_mem_outerspace.getWatchAddress() << endl; m_log << "restoring state" << endl;
simulator.addListener(&l_trap); // Restore to the image, which starts at address(main)
simulator.addListener(&l_error); simulator.restore("state");
simulator.addListener(&l_nullp); executed_jobs ++;
simulator.addListener(&l_oobounds);
simulator.addListener(&l_dump);
simulator.addListener(&l_parity);
simulator.addListener(&l_mem_text);
simulator.addListener(&l_mem_outerspace);
simulator.addListener(&l_mem_textcdx_det);
// resume and wait for results
fail::BaseListener* l = simulator.resume();
// Evaluate result m_log << "Trying to inject @ instr #" << dec << injection_instr << endl;
if(l == &l_error) {
handleEvent(param, param.msg.EXC_ERROR, "exc error");
} else if ( l == &l_nullp ) {
handleEvent(param, param.msg.EXC_NULLPOINTER, "exc nullpointer");
} else if ( l == &l_oobounds ) { if (injection_instr > 0) {
handleEvent(param, param.msg.EXC_OOBOUNDS, "exc out of bounds"); simulator.clearListeners();
// XXX could be improved with intermediate states (reducing runtime until injection)
simulator.addListener(&l_dump);
} else if (l == &l_dump) { BPSingleListener bp;
handleEvent(param, param.msg.CALCDONE, "calculation done"); bp.setWatchInstructionPointer(ANY_ADDR);
bp.setCounter(injection_instr + 1);
simulator.addListener(&bp);
} else if (l == &l_parity) { bool inject = true;
handleEvent(param, param.msg.EXC_PARITY, "exc parity"); while (1) {
fail::BaseListener * listener = simulator.resume();
// finish() before FI?
if (listener == &l_dump) {
m_log << "experiment reached finish() before FI" << endl;
handleEvent(*result, result->NOINJECTION, "time_marker reached before instr2");
inject = false;
break;
} else if (listener == &bp) {
break;
} else {
inject = false;
handleEvent(*result, result->NOINJECTION, "WTF");
break;
}
}
} else if (l == &l_trap) { // Next experiment
stringstream sstr; if (!inject)
sstr << "trap #" << l_trap.getTriggerNumber(); continue;
handleEvent(param, param.msg.TRAP, sstr.str()); }
address_t injection_instr_absolute = param.msg.fsppilot().injection_instr_absolute();
if (simulator.getCPU(0).getInstructionPointer() != injection_instr_absolute) {
m_log << "Invalid Injection address EIP=0x"
<< std::hex << simulator.getCPU(0).getInstructionPointer()
<< " != 0x" << injection_instr_absolute << std::endl;
simulator.terminate(1);
}
} else if (l == &l_mem_text){ /// INJECT BITFLIP:
handleMemoryAccessEvent(param, l_mem_text); result->set_original_value(injectBitFlip(data_address, bit_offset));
} else if (l == &l_mem_textcdx_det){ cout << " outerspace : " << l_mem_outerspace.getWatchWidth() << " --- @ :" << l_mem_outerspace.getWatchAddress() << endl;
handleMemoryAccessEvent(param, l_mem_textcdx_det); simulator.clearListeners();
simulator.addListener(&l_trap);
if (s_error.isValid())
simulator.addListener(&l_error);
if (s_nullp.isValid())
simulator.addListener(&l_nullp);
if (s_oobounds.isValid())
simulator.addListener(&l_oobounds);
simulator.addListener(&l_dump);
if (s_parity.isValid())
simulator.addListener(&l_parity);
simulator.addListener(&l_mem_text);
simulator.addListener(&l_mem_outerspace);
simulator.addListener(&l_timeout);
m_log << "Resuming till the crash" << std::endl;
// resume and wait for results
fail::BaseListener* l = simulator.resume();
m_log << "CDX has ended" << std::endl;
} else if (l == &l_mem_outerspace){ // Evaluate result
handleMemoryAccessEvent(param, l_mem_outerspace); if(l == &l_error) {
handleEvent(*result, result->EXC_ERROR, "exc error");
} else if ( l == &l_nullp ) {
handleEvent(*result, result->EXC_NULLPOINTER, "exc nullpointer");
} else { } else if ( l == &l_oobounds ) {
handleEvent(param, param.msg.UNKNOWN, "UNKNOWN event"); handleEvent(*result, result->EXC_OOBOUNDS, "exc out of bounds");
}
simulator.clearListeners(); } else if (l == &l_dump) {
m_jc.sendResult(param); handleEvent(*result, result->CALCDONE, "calculation done");
} // end while (1)
// Explicitly terminate, or the simulator will continue to run. } else if (l == &l_parity) {
#endif handleEvent(*result, result->EXC_PARITY, "exc parity");
simulator.terminate();
} else if (l == &l_timeout) {
handleEvent(*result, result->TIMEOUT, "1s");
} else if (l == &l_trap) {
stringstream sstr;
sstr << "trap #" << l_trap.getTriggerNumber();
handleEvent(*result, result->TRAP, sstr.str());
} else if (l == &l_mem_text){
handleMemoryAccessEvent(*result, l_mem_text);
} else if (l == &l_mem_outerspace){
handleMemoryAccessEvent(*result, l_mem_outerspace);
} else {
handleEvent(*result, result->UNKNOWN, "UNKNOWN event");
}
simulator.clearListeners();
}
m_jc.sendResult(param);
}
// Explicitly terminate, or the simulator will continue to run.
simulator.terminate();
} }

47
src/experiments/kesorefs/kesoref.proto
View File

@ -1,27 +1,26 @@
message KesoRefProtoMsg { import "DatabaseCampaignMessage.proto";
// parameters
required int32 pc_address = 1;
required int32 ram_address = 2;
required int32 bit_offset = 3;
// results message KesoRefProtoMsg {
// make these optional to reduce overhead for server->client communication required DatabaseCampaignMessage fsppilot = 1;
enum ResultType {
CALCDONE = 1; repeated group Result = 2 {
TIMEOUT = 2; // make these optional to reduce overhead for server->client communication
TRAP = 3; enum ResultType {
EXC_ERROR = 4; CALCDONE = 1;
EXC_PARITY = 5; TIMEOUT = 2;
EXC_NULLPOINTER = 6; TRAP = 3;
EXC_OOBOUNDS = 7; EXC_ERROR = 4;
MEMACCESS = 8; EXC_PARITY = 5;
UNKNOWN = 9; EXC_NULLPOINTER = 6;
EXC_OOBOUNDS = 7;
MEMACCESS = 8;
NOINJECTION = 9;
UNKNOWN = 10;
}
// result type, see above
required ResultType resulttype = 4;
required uint32 original_value = 5;
required uint32 bitoffset = 6 [(sql_primary_key) = true];
optional string details = 7;
} }
// result type, see above
optional ResultType resulttype = 4;
optional uint32 original_value = 5;
// did ECC correct the fault?
//optional int32 error_corrected = 6;
// optional textual description of what happened
optional string details = 7;
} }

5
src/experiments/kesorefs/main.cc
View File

@ -2,10 +2,15 @@
#include <cstdlib> #include <cstdlib>
#include "cpn/CampaignManager.hpp" #include "cpn/CampaignManager.hpp"
#include "util/CommandLine.hpp"
#include "campaign.hpp" #include "campaign.hpp"
int main(int argc, char **argv) int main(int argc, char **argv)
{ {
fail::CommandLine &cmd = fail::CommandLine::Inst();
for (int i = 1; i < argc; ++i)
cmd.add_args(argv[i]);
KesoRefCampaign c; KesoRefCampaign c;
if (fail::campaignmanager.runCampaign(&c)) { if (fail::campaignmanager.runCampaign(&c)) {
return 0; return 0;