christoph/fail
1
Fork 0
Code Actions Packages Releases Activity

Preparing CiAO experiments

Browse Source 
git-svn-id: https://www4.informatik.uni-erlangen.de/i4svn/danceos/trunk/devel/fail@1984 8c4709b5-6ec9-48aa-a5cd-a96041d1645a
This commit is contained in:
hoffmann
2012-12-20 22:37:29 +00:00
parent 5a3a66da25
commit e5323abcf9
1 changed files with 96 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

178
src/experiments/vezs-example/experiment.cc
View File

@ -24,108 +24,122 @@ using namespace fail;
// Check if configuration dependencies are satisfied: // Check if configuration dependencies are satisfied:
#if !defined(CONFIG_EVENT_BREAKPOINTS) || !defined(CONFIG_SR_RESTORE) || \ #if !defined(CONFIG_EVENT_BREAKPOINTS) || !defined(CONFIG_SR_RESTORE) || \
!defined(CONFIG_SR_SAVE) || !defined(CONFIG_EVENT_TRAP) !defined(CONFIG_SR_SAVE)
#error This experiment needs: breakpoints, traps, save, and restore. Enable these in the configuration. #error This experiment needs: breakpoints, traps, save, and restore. Enable these in the configuration.
#endif #endif
bool VEZSExperiment::run() bool VEZSExperiment::run()
{ {
Logger log("VEZS-Example", false); Logger log("VEZS-Example", false);
ElfReader elf("./system"); ElfReader elf("./x86_bare_test");
log << elf.getAddressByName("main") << endl; log << "STARTING EXPERIMENT" << endl;
log << "main() address: " << elf.getAddressByName("main") << endl;
BPSingleListener bp;
BPSingleListener bp;
#if 0 #if 0
// STEP 1: run until interesting function starts, and save state // STEP 1: run until interesting function starts, and save state
bp.setWatchInstructionPointer(elf.getAddressByName("main")); bp.setWatchInstructionPointer(elf.getAddressByName("main"));
if(simulator.addListenerAndResume(&bp) == &bp){ if(simulator.addListenerAndResume(&bp) == &bp){
log << "test function entry reached, saving state" << endl; log << "test function entry reached, saving state" << endl;
} }
log << "EIP = " << hex << bp.getTriggerInstructionPointer() << " or " << simulator.getRegisterManager().getInstructionPointer() << endl; log << "EIP = " << hex << bp.getTriggerInstructionPointer() << endl;
//simulator.terminate(); //simulator.terminate();
simulator.save("vezs.state"); simulator.save("vezs.state");
simulator.terminate(); simulator.terminate();
#endif #endif
#if 1 #if 1
int bit_offset = 2; //int bit_offset = 2;
for (int instr_offset = 0; instr_offset < OOSTUBS_NUMINSTR; ++instr_offset) { //for (int instr_offset = 0; instr_offset < OOSTUBS_NUMINSTR; ++instr_offset) {
// STEP 3: The actual experiment. // STEP 3: The actual experiment.
log << "restoring state" << endl; log << "restoring state" << endl;
simulator.restore("vezs.state"); simulator.restore("vezs.state");
log << "EIP = " << hex << simulator.getRegisterManager().getInstructionPointer() << endl; log << " current EIP = " << simulator.getCPU(0).getInstructionPointer() << endl;
log << " Task0 start: " << elf.getAddressByName("_ZN5Alpha17functionTaskTask0Ev") << endl;
BPSingleListener bpt0;
BPSingleListener bpt1;
bpt0.setWatchInstructionPointer(elf.getAddressByName("_ZN5Alpha17functionTaskTask0Ev"));
bpt1.setWatchInstructionPointer(elf.getAddressByName("_ZN4Beta17functionTaskTask1Ev"));
bp.setWatchInstructionPointer(ANY_ADDR); simulator.addListener(&bpt1);
for (int count = 0; count < instr_offset; ++count) { simulator.addListenerAndResume(&bpt0);
simulator.addListenerAndResume(&bp); log << "EIP = " << simulator.getCPU(0).getInstructionPointer() <<" "<<elf.getNameByAddress(simulator.getCPU(0).getInstructionPointer()) << endl;
} simulator.resume();
log << "EIP = " << simulator.getCPU(0).getInstructionPointer() <<" "<<elf.getNameByAddress(simulator.getCPU(0).getInstructionPointer()) << endl;
int32_t data = simulator.getRegisterManager().getRegister(RID_CAX)->getData();
// The INJECTION:
int32_t newdata = data ^ (1<<bit_offset);
simulator.getRegisterManager().getRegister(RID_CAX)->setData(newdata);
int32_t injection_ip = simulator.getRegisterManager().getInstructionPointer();
log << "inject @ ip " << injection_ip
<< " (offset " << dec << instr_offset << ")"
<< " bit " << bit_offset << ": 0x"
<< hex << ((int)data) << " -> 0x" << ((int)newdata) << endl;
// --- aftermath ---
// possible outcomes:
// - trap, "crash"
// - jump outside text segment
// - reaches THE END
// - error detected, stop
// additional info:
// - #loop iterations before/after FI
// catch traps as "extraordinary" ending simulator.clearListeners();
TroubleListener ev_trap(ANY_TRAP); bpt1.setWatchInstructionPointer(elf.getAddressByName("_ZN2os3krn9SchedImpl18superDispatch_implEPS1_hh"));
simulator.addListener(&ev_trap); for(int i = 0; i < 10; i++){
// jump outside text segment simulator.addListenerAndResume(&bpt1);
BPRangeListener ev_below_text(ANY_ADDR, OOSTUBS_TEXT_START - 1); log << "EIP = " << simulator.getCPU(0).getInstructionPointer() <<" "<<elf.getNameByAddress(simulator.getCPU(0).getInstructionPointer()) << endl;
BPRangeListener ev_beyond_text(OOSTUBS_TEXT_END + 1, ANY_ADDR); }
simulator.addListener(&ev_below_text); #endif
simulator.addListener(&ev_beyond_text); #if 0
// timeout (e.g., stuck in a HLT instruction) int32_t data = simulator.getCPU(0).getRegister(RID_CAX)->getData();
// 10000us = 500000 instructions // The INJECTION:
GenericTimerListener ev_timeout(1000000); // 50,000,000 instructions !! int32_t newdata = data ^ (1<<bit_offset);
simulator.addListener(&ev_timeout); simulator.getCPU(0).getRegister(RID_CAX)->setData(newdata);
// remaining instructions until "normal" ending int32_t injection_ip = simulator.getCPU(0).getInstructionPointer();
BPSingleListener ev_end(ANY_ADDR); log << "inject @ ip " << injection_ip
ev_end.setCounter(OOSTUBS_NUMINSTR - instr_offset); << " (offset " << dec << instr_offset << ")"
simulator.addListener(&ev_end); << " bit " << bit_offset << ": 0x"
<< hex << ((int)data) << " -> 0x" << ((int)newdata) << endl;
// Start simulator and wait for any result // --- aftermath ---
BaseListener* ev = simulator.resume(); // possible outcomes:
// - trap, "crash"
// - jump outside text segment
// - reaches THE END
// - error detected, stop
// additional info:
// - #loop iterations before/after FI
// record latest IP regardless of result // catch traps as "extraordinary" ending
injection_ip = simulator.getRegisterManager().getInstructionPointer(); TroubleListener ev_trap(ANY_TRAP);
simulator.addListener(&ev_trap);
// jump outside text segment
BPRangeListener ev_below_text(ANY_ADDR, OOSTUBS_TEXT_START - 1);
BPRangeListener ev_beyond_text(OOSTUBS_TEXT_END + 1, ANY_ADDR);
simulator.addListener(&ev_below_text);
simulator.addListener(&ev_beyond_text);
// timeout (e.g., stuck in a HLT instruction)
// 10000us = 500000 instructions
GenericTimerListener ev_timeout(1000000); // 50,000,000 instructions !!
simulator.addListener(&ev_timeout);
// remaining instructions until "normal" ending
BPSingleListener ev_end(ANY_ADDR);
ev_end.setCounter(OOSTUBS_NUMINSTR - instr_offset);
simulator.addListener(&ev_end);
// Start simulator and wait for any result
BaseListener* ev = simulator.resume();
// record latest IP regardless of result
injection_ip = simulator.getCPU(0).getInstructionPointer();
if (ev == &ev_end) { if (ev == &ev_end) {
log << dec << "Result FINISHED" << endl; log << dec << "Result FINISHED" << endl;
} else if (ev == &ev_timeout) { } else if (ev == &ev_timeout) {
log << "Result TIMEOUT" << endl; log << "Result TIMEOUT" << endl;
} else if (ev == &ev_below_text || ev == &ev_beyond_text) { } else if (ev == &ev_below_text || ev == &ev_beyond_text) {
log << "Result OUTSIDE" << endl; log << "Result OUTSIDE" << endl;
} else if (ev == &ev_trap) { } else if (ev == &ev_trap) {
log << dec << "Result TRAP #" << ev_trap.getTriggerNumber() << endl; log << dec << "Result TRAP #" << ev_trap.getTriggerNumber() << endl;
} else { } else {
log << "Result WTF?" << endl; log << "Result WTF?" << endl;
} }
log << "@ ip 0x" << hex << injection_ip << endl; log << "@ ip 0x" << hex << injection_ip << endl;
// explicitly remove all events before we leave their scope // explicitly remove all events before we leave their scope
// FIXME event destructors should remove them from the queues // FIXME event destructors should remove them from the queues
simulator.clearListeners(); simulator.clearListeners();
} }
#endif #endif
// Explicitly terminate, or the simulator will continue to run. // Explicitly terminate, or the simulator will continue to run.
simulator.terminate(); simulator.terminate();
} }