Skip to content

Fix correctness bugs: NULL symbol deref, register-buffer overflow, memory-range calculation #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HeavenlyDevv wants to merge 1 commit into
base: extensions
Choose a base branch
from
Open

Fix correctness bugs: NULL symbol deref, register-buffer overflow, memory-range calculation #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions sofia-ovp/FI.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,8 @@ function generateFaultList2 {
EntryAddress=$( A=$(grep "\.text" applicationSections) ; echo "${A#*PROGBITS}" | tr -s ' ' | cut -d " " -f2 )
# Allocated Flash Memory
FlashSize=$( A=$(grep "\.text" applicationSections) ; echo "${A#*PROGBITS}" | tr -s ' ' | cut -d " " -f4 )
# Flash end address = start + size (was passing the size itself as an address)
FlashEnd=$(printf "%016x" $((0x$EntryAddress + 0x$FlashSize)))
# RAM entry address
RAMDataAddress=$( A=$(grep "\.data" applicationSections) ; echo "${A#*PROGBITS}" | tr -s ' ' | cut -d " " -f2 )
# DATA Allocated RAM
Expand All @@ -120,19 +122,19 @@ function generateFaultList2 {
RAMBSSAddress=$( A=$(grep "\.bss" applicationSections) ; echo "${A#*NOBITS}" | tr -s ' ' | cut -d " " -f2 )
# BSS Allocated RAM
RAMBSSSize=$( A=$(grep "\.bss" applicationSections) ; echo "${A#*NOBITS}" | tr -s ' ' | cut -d " " -f4 )
# RAM Final Address
RAMEnd=$( A=$(grep "\.heap" applicationSections) ; echo "${A#*PROGBITS}" | tr -s ' ' | cut -d " " -f2 )
# RAM Final Address = data start + bss size (there is no .heap section in baremetal binaries)
RAMEnd=$(printf "%016x" $((0x$RAMDataAddress + 0x$RAMBSSSize)))
# Output to memory detailing file
echo "$CURRENT_APPLICATION Memory Detailement on $ARCHITECTURE (Sizes are in bytes)" &>> memory_details.log
echo "application, flash_start, flash_end, ram_start, ram_end, flash_size, data_size, bss_size, total_ram_size" &>> memory_details.log
echo "$CURRENT_APPLICATION, $EntryAddress, $FlashSize, $RAMDataAddress, $RAMEnd, $( echo "ibase=16;obase=A; $( echo "$FlashSize" | tr "a-z" "A-Z")" | bc ), $( echo "ibase=16;obase=A; $( echo "$RAMDataSize" | tr "a-z" "A-Z")" | bc ), $( echo "ibase=16;obase=A; $( echo "$RAMBSSSize" | tr "a-z" "A-Z")" | bc ), $( echo "ibase=16;obase=A; $( echo "$RAMDataSize+$RAMBSSSize" | tr "a-z" "A-Z")" | bc )" &>> memory_details.log
echo "$CURRENT_APPLICATION, $EntryAddress, $FlashEnd, $RAMDataAddress, $RAMEnd, $( echo "ibase=16;obase=A; $( echo "$FlashSize" | tr "a-z" "A-Z")" | bc ), $( echo "ibase=16;obase=A; $( echo "$RAMDataSize" | tr "a-z" "A-Z")" | bc ), $( echo "ibase=16;obase=A; $( echo "$RAMBSSSize" | tr "a-z" "A-Z")" | bc ), $( echo "ibase=16;obase=A; $( echo "$RAMDataSize+$RAMBSSSize" | tr "a-z" "A-Z")" | bc )" &>> memory_details.log
if [ -z $MEMORY_OPTIONS ]; then
CMD_FAULT_LIST="$CMD_FAULT_LIST --memlowaddress=$( echo "ibase=16;obase=A; $( echo "$EntryAddress" | tr "a-z" "A-Z")" | bc ) \
--memhighaddress=$( echo "ibase=16;obase=A; $( echo "$RAMEnd" | tr "a-z" "A-Z")" | bc )"
else
if [ $MEMORY_OPTIONS == "FLASH" ]; then
CMD_FAULT_LIST="$CMD_FAULT_LIST --memlowaddress=$( echo "ibase=16;obase=A; $( echo "$EntryAddress" | tr "a-z" "A-Z")" | bc ) \
--memhighaddress=$( echo "ibase=16;obase=A; $( echo "$FlashSize" | tr "a-z" "A-Z")" | bc )"
--memhighaddress=$( echo "ibase=16;obase=A; $( echo "$FlashEnd" | tr "a-z" "A-Z")" | bc )"
fi
if [ $MEMORY_OPTIONS == "RAM" ]; then
CMD_FAULT_LIST="$CMD_FAULT_LIST --memlowaddress=$( echo "ibase=16;obase=A; $( echo "$RAMDataAddress" | tr "a-z" "A-Z")" | bc ) \
Expand Down
7 changes: 6 additions & 1 deletion sofia-ovp/platformOP/commonStructsAndEnumerators.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,12 @@
/////////////////////////////////////////////////////////////////////////

#define END_LIST "EndList@"
char possibleRegisters[50][10];
// Working buffer that holds the active arch's register list (copied in faultInjector.c).
// Must cover the largest list: ARMv8 int(33)+SIMD(32)+END = 66 entries already exceed 50.
// MAX_REGISTERS gives headroom; bump it if a longer list is ever added.
#define MAX_REGISTERS 80
#define MAX_REGISTER_NAME_LEN 10
char possibleRegisters[MAX_REGISTERS][MAX_REGISTER_NAME_LEN];
int numberOfRegistersToCompare;
const char possibleRegistersV7[][10] ={"r0","r1","r2","r3","r4","r5","r6","r7","r8","r9","r10","r11","r12","sp","lr","pc","d0","d1","d2","d3","d4","d5","d6","d7","d8","d9","d10","d11","d12","d13","d14","d15",END_LIST};
const char possibleRegistersV8[][10] ={"x0","x1","x2","x3","x4","x5","x6","x7","x8","x9","x10","x11","x12","x13","x14","x15","x16","x17","x18","x19","x20","x21","x22","x23","x24","x25","x26","x27","x28","x29","x30","sp","pc","v0","v1","v2","v3","v4","v5","v6","v7","v8","v9","v10","v11","v12","v13","v14","v15","v16","v17","v18","v19","v20","v21","v22","v23","v24","v25","v26","v27","v28","v29","v30","v31",END_LIST};
Expand Down
4 changes: 4 additions & 0 deletions sofia-ovp/platformOP/harness/faultInjector.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,13 +186,16 @@ void initialize() {
do {numberOfRegistersToCompare++;}
while(strcmp(END_LIST,possibleRegistersV7[numberOfRegistersToCompare]) != 0 );

// guard: never write past possibleRegisters[MAX_REGISTERS]
if(numberOfRegistersToCompare > MAX_REGISTERS) numberOfRegistersToCompare = MAX_REGISTERS;
for(int i=0; i<numberOfRegistersToCompare; i++)
strcpy(possibleRegisters[i],possibleRegistersV7[i]);
} else if(!strcmp(options.environment,"ovparmv8")) {
numberOfRegistersToCompare=-2;
do {numberOfRegistersToCompare++;}
while(strcmp(END_LIST,possibleRegistersV8[numberOfRegistersToCompare]) != 0 );

if(numberOfRegistersToCompare > MAX_REGISTERS) numberOfRegistersToCompare = MAX_REGISTERS;
for(int i=0; i<numberOfRegistersToCompare; i++)
strcpy(possibleRegisters[i],possibleRegistersV8[i]);
}
Expand All @@ -202,6 +205,7 @@ void initialize() {
do {numberOfRegistersToCompare++;}
while(strcmp(END_LIST,possibleRegistersRV[numberOfRegistersToCompare]) != 0 );

if(numberOfRegistersToCompare > MAX_REGISTERS) numberOfRegistersToCompare = MAX_REGISTERS;
for(int i=0; i<numberOfRegistersToCompare; i++)
strcpy(possibleRegisters[i],possibleRegistersRV[i]);
}
Expand Down
147 changes: 96 additions & 51 deletions sofia-ovp/platformOP/intercept/intercept.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,21 +199,50 @@ static VMI_MEM_WATCH_FN(traceVariableCB) {
//
// Acquire the contents of a given symbol and returns in a buffer
// TODO: Allocate the buffer internally and automatically?
// Null-safe: if the traced symbol is not found (e.g. a bad TRACE_VARIABLE name), the
// original code dereferenced a NULL symbol and read from a garbage address, aborting the
// simulator. We guard every pointer and only read memory when the symbol is found
// (trying the processor first, then its SMP parent).
void getSymbolValue(vmiProcessorP processor, const char* symbolName, void* buffer) {
memDomainP dataDomain = vmirtGetProcessorDataDomain(processor); /// data domain
if (processor == NULL) {
vmiMessage("F", PREFIX_FIM_TRACE_FUNCTION, "getSymbolValue called with NULL processor");
return;
}
if (symbolName == NULL) {
vmiMessage("F", PREFIX_FIM_TRACE_FUNCTION, "getSymbolValue called with NULL symbolName");
return;
}
if (buffer == NULL) {
vmiMessage("F", PREFIX_FIM_TRACE_FUNCTION, "getSymbolValue called with NULL buffer");
return;
}

/// get the function symbol
vmiSymbolCP funcSymbol = vmirtGetSymbolByName(vmirtGetSMPParent(processor), symbolName);
Addr funcAddress = vmirtGetSymbolAddr(funcSymbol);
Addr funcSize = vmirtGetSymbolSize(funcSymbol);
memDomainP dataDomain = vmirtGetProcessorDataDomain(processor); /// data domain
if (dataDomain == NULL) {
vmiMessage("F", PREFIX_FIM_TRACE_FUNCTION, "Failed to get data domain for processor %s",
vmirtProcessorName(processor));
return;
}

if(funcSymbol) {
vmiMessage("I",PREFIX_FIM_TRACE_FUNCTION,"Symbol '%s' found (VA:"FMT_64x" SIZE:"FMT_64u") \n",vmirtGetSymbolName(funcSymbol),funcAddress,funcSize);
} else {
vmiMessage("F",PREFIX_FIM_TRACE_FUNCTION,"Symbol '%s' not found \n",vmirtGetSymbolName(funcSymbol));
/// get the function symbol from the processor itself first
vmiSymbolCP funcSymbol = vmirtGetSymbolByName(processor, symbolName);
/// if not found and processor has an SMP parent, try the parent
if (funcSymbol == NULL) {
vmiProcessorP smpParent = vmirtGetSMPParent(processor);
if (smpParent != NULL) {
funcSymbol = vmirtGetSymbolByName(smpParent, symbolName);
}
}

vmirtReadNByteDomain(dataDomain,funcAddress,buffer,funcSize, 0, MEM_AA_FALSE);
if (funcSymbol) {
Addr funcAddress = vmirtGetSymbolAddr(funcSymbol);
Addr funcSize = vmirtGetSymbolSize(funcSymbol);
vmiMessage("I", PREFIX_FIM_TRACE_FUNCTION, "Symbol '%s' found (VA:"FMT_64x" SIZE:"FMT_64u") \n",
vmirtGetSymbolName(funcSymbol), funcAddress, funcSize);
vmirtReadNByteDomain(dataDomain, funcAddress, buffer, funcSize, 0, MEM_AA_FALSE);
} else {
vmiMessage("F", PREFIX_FIM_TRACE_FUNCTION, "Symbol '%s' not found \n", symbolName);
}
}

////////////////////////////////////////////////////////////////////////////////
Expand Down Expand Up @@ -522,16 +551,22 @@ static VMIOS_INTERCEPT_FN(serviceHandler) {
/// Variable type two
if(MACRO_FAULTTYPE(TYPE_VARIABLE2)) {
vmiSymbolCP funcSymbol = vmirtGetSymbolByName(vmirtGetSMPParent(processor), processorData->options.tracesymbol);
Addr funcSize = vmirtGetSymbolSize(funcSymbol);
// Get final the reference result
char* buffer = (char*) malloc (sizeof(char) * funcSize);
getSymbolValue(processor,processorData->options.tracesymbol,buffer);
// Gold file
sprintf(tempString,FOLDER_DUMPS"/"FILE_NAME_TRACE"-%d",processorData->MACRO_PLATFORM_ID);
fileTrace = fopen (tempString,"wb");
// Write
fwrite(buffer,sizeof(char),funcSize,fileTrace);
fclose(fileTrace);
// guard: symbol missing -> vmirtGetSymbolSize(NULL) aborts the simulator
if(!funcSymbol) {
vmiMessage("F",PREFIX_FIM_TRACE_FUNCTION,"Symbol '%s' not found \n",processorData->options.tracesymbol);
} else {
Addr funcSize = vmirtGetSymbolSize(funcSymbol);
// Get final the reference result
char* buffer = (char*) malloc (sizeof(char) * funcSize);
getSymbolValue(processor,processorData->options.tracesymbol,buffer);
// Gold file
sprintf(tempString,FOLDER_DUMPS"/"FILE_NAME_TRACE"-%d",processorData->MACRO_PLATFORM_ID);
fileTrace = fopen (tempString,"wb");
// Write
fwrite(buffer,sizeof(char),funcSize,fileTrace);
fclose(fileTrace);
free(buffer);
}
}
// Enable trace to a given variable
if(processorData->options.tracevariable){
Expand All @@ -544,19 +579,24 @@ static VMIOS_INTERCEPT_FN(serviceHandler) {
// Cortex-M or baremetal
varSymbol = vmirtGetSymbolByName(processor, processorData->options.tracevariable);
}
Addr varSize = vmirtGetSymbolSize(varSymbol);
// Get final the reference result
char* buffer = (char*) malloc (sizeof(char) * varSize);
getSymbolValue(processor,processorData->options.tracevariable,buffer);
// Gold file
sprintf(tempString,FOLDER_DUMPS"/trace_gold_variable-%d",processorData->MACRO_PLATFORM_ID);
fileTrace = fopen (tempString,"w+");
// Write
//fwrite(buffer,sizeof(char),funcSize,fileTrace);
for (int i=0; i<varSize;i++){
fprintf(fileTrace,"%02hhX ",buffer[i]);
// guard: variable symbol missing -> vmirtGetSymbolSize(NULL) aborts the simulator
if(!varSymbol) {
vmiMessage("F", PREFIX_FIM, "Traced variable '%s' not found, skipping gold trace\n", processorData->options.tracevariable);
} else {
Addr varSize = vmirtGetSymbolSize(varSymbol);
// Get final the reference result
char* buffer = (char*) malloc (sizeof(char) * varSize);
getSymbolValue(processor,processorData->options.tracevariable,buffer);
// Gold file
sprintf(tempString,FOLDER_DUMPS"/trace_gold_variable-%d",processorData->MACRO_PLATFORM_ID);
fileTrace = fopen (tempString,"w+");
// Write
for (int i=0; i<varSize;i++){
fprintf(fileTrace,"%02hhX ",buffer[i]);
}
fclose(fileTrace);
free(buffer);
}
fclose(fileTrace);
}

} else { // Fault Injection Platform
Expand All @@ -569,6 +609,10 @@ static VMIOS_INTERCEPT_FN(serviceHandler) {

// Symbol attributes
vmiSymbolCP funcSymbol = vmirtGetSymbolByName(vmirtGetSMPParent(processor), processorData->options.tracesymbol);
// guard: symbol missing -> vmirtGetSymbolAddr/Size(NULL) aborts the simulator
if(!funcSymbol) {
vmiMessage("F",PREFIX_FIM_TRACE_FUNCTION,"Symbol '%s' not found, skipping variable comparison\n",processorData->options.tracesymbol);
} else {
Addr funcAddress = vmirtGetSymbolAddr(funcSymbol);
Addr funcSize = vmirtGetSymbolSize(funcSymbol);

Expand Down Expand Up @@ -620,13 +664,9 @@ static VMIOS_INTERCEPT_FN(serviceHandler) {
vmiPrintf("SDC2\n");
}

//Dump fault final result
//~ sprintf(tempString,FOLDER_DUMPS"/"FILE_NAME_TRACE"-%d",processorData->MACRO_PLATFORM_ID);
//~ fileTrace = fopen (tempString,"wb");

// Write
//~ fwrite(buffer,sizeof(char),funcSize,fileTrace);
//~ fclose(fileTrace);
free(buffer);
free(gold);
} // end guard: funcSymbol found
}
// Enable trace to a given variable
if(processorData->options.tracevariable){
Expand All @@ -639,19 +679,24 @@ static VMIOS_INTERCEPT_FN(serviceHandler) {
// Cortex-M or baremetal
varSymbol = vmirtGetSymbolByName(processor, processorData->options.tracevariable);
}
Addr varSize = vmirtGetSymbolSize(varSymbol);
// Get final the reference result
char* buffer = (char*) malloc (sizeof(char) * varSize);
getSymbolValue(processor,processorData->options.tracevariable,buffer);
// Gold file
sprintf(tempString,FOLDER_DUMPS"/trace_fault_variable-%d",processorData->MACRO_PLATFORM_ID);
fileTrace = fopen (tempString,"w+");
// Write
//fwrite(buffer,sizeof(char),funcSize,fileTrace);
for (int i=0; i<varSize;i++){
fprintf(fileTrace,"%02hhX ",buffer[i]);
// guard: variable symbol missing -> vmirtGetSymbolSize(NULL) aborts the simulator
if(!varSymbol) {
vmiMessage("F", PREFIX_FIM, "Traced variable '%s' not found, skipping fault trace\n", processorData->options.tracevariable);
} else {
Addr varSize = vmirtGetSymbolSize(varSymbol);
// Get final the reference result
char* buffer = (char*) malloc (sizeof(char) * varSize);
getSymbolValue(processor,processorData->options.tracevariable,buffer);
// Gold file
sprintf(tempString,FOLDER_DUMPS"/trace_fault_variable-%d",processorData->MACRO_PLATFORM_ID);
fileTrace = fopen (tempString,"w+");
// Write
for (int i=0; i<varSize;i++){
fprintf(fileTrace,"%02hhX ",buffer[i]);
}
fclose(fileTrace);
free(buffer);
}
fclose(fileTrace);
}
}
break; }
Expand Down