Page fault cleanup

Author: AndrewFasano

panda/python/examples/fault.py

@@ -2,15 +2,23 @@
 
 panda = Panda(generic="arm")
 #panda = Panda(generic="i386")
-#panda = Panda(generic="x86_64")
+#panda = Panda(generic="x86_64") # Infinte faults
 #panda = Panda(generic="mips64")
 
 panda.load_plugin("syscalls2", {"load-info": True})
 
+paged_in = 0
+faulted = 0
+faulted_then_resolved = 0
+faulted_then_failed = 0
+
 @panda.queue_blocking
 def drive():
     panda.revert_sync('root')
-    print(panda.run_serial_cmd("md5sum $(which whoami); find /etc/ | md5sum; apt-get update -yy"))
+    try:
+        print(panda.run_serial_cmd("md5sum $(which whoami); find /etc/ | md5sum; timeout 10s apt-get update -yy"))
+    except Exception as e:
+        print("EXN:", e)
     panda.end_analysis()
 
 last_fault = None
@@ -24,10 +32,14 @@ def fault(panda, cpu, addr, pc):
 
 @panda.ppp("syscalls2", "on_all_sys_enter2")
 def all_sys(cpu, pc, call, rp):
+    if call == panda.ffi.NULL:
+        print("CALL ISNULL")
+        return
     args = panda.ffi.cast("target_ulong**", rp.args)
+    asid = panda.current_asid(cpu)
 
     sc_name = panda.ffi.string(call.name).decode() if call.name != panda.ffi.NULL else 'err'
-    print(f"{pc:#08x} (from block starting at {panda.current_pc(cpu):#08x}): {sc_name}(", end="")
+    print(f"{pc:#08x} {asid:#08x} (from block starting at {panda.current_pc(cpu):#08x}): {sc_name}(", end="")
     if call.nargs == 0:
         print(")", end="")
 
@@ -38,7 +50,7 @@ def all_sys(cpu, pc, call, rp):
 
         if call.argt[i] not in [0x20, 0x21, 0x22]:
             val = int(panda.ffi.cast("unsigned int", args[i]))
-            print(hex(val), end="")
+            print(hex(val), end=sep)
             continue
 
         # It's a pointer type
@@ -47,16 +59,23 @@ def all_sys(cpu, pc, call, rp):
             # Probably not a pointer?
             print(hex(addr), end="")
         else:
+            global faulted, faulted_then_resolved, faulted_then_failed
             try:
                 s = panda.read_str(cpu, addr)
+                if addr == last_fault: # faulted before, then resolved
+                    s += f"(PANDA: read now works faulted_then_resolved now {faulted_then_resolved+1})"
+                    faulted_then_resolved += 1 
             except ValueError:
                 # This argument can't be read - let's raise a fault on it
-                if last_fault != addr:
-                    print(f"{addr:#x} => Can't read - INJECT PANDA PAGE FAULT") # newline
+                if last_fault != addr: # fault on new address
+                    print(f"{addr:#x} => Can't read - INJECT PANDA PAGE FAULT, faulted is now {faulted+1}") # newline
+                    faulted += 1
                     fault(panda, cpu, addr, pc)
                     return # Raised a fault, hope it's gonna work
                 else:
-                    s = "still can't read"
+                    # faulted then failed
+                    faulted_then_failed += 1
+                    s = f"still can't read (faulted_then_failed now {faulted_then_failed+1}"
 
             # No fault
             print(f"{addr:#x} => {repr(s)}", end="")
@@ -72,3 +91,5 @@ def all_ret(cpu, pc, call, rp):
 # XXX: with TB chaining there's a gap between when the syscall happens and our injected PF is handled
 #panda.disable_tb_chaining()
 panda.run()
+
+print(f"\nFINISHED!\nTotal of {faulted} faults seen\n\t{faulted_then_resolved} resolved\n\t{faulted_then_failed} failed")

panda/src/panda_api.c

@@ -303,16 +303,21 @@ void panda_page_fault(CPUState* cpu, target_ulong address, target_ulong retaddr)
     // instead of restarting the block
     env->eip = retaddr;
     tlb_fill(cpu, address, MMU_DATA_LOAD, 0, retaddr);
-//#elif defined (TARGET_ARM)
-//    CPUARMState *env = cpu->env_ptr;
-//    env->pc = retaddr;
-//    tlb_fill(cpu, address, MMU_DATA_LOAD, 0, retaddr);
+#elif defined (TARGET_ARM)
+    CPUARMState *env = cpu->env_ptr;
+    if (is_a64(env)) {
+      env->pc = retaddr; // PC for aarch64
+    } else {
+      env->regs[15] = retaddr; // PC for arm32
+    }
+    tlb_fill(cpu, address, MMU_DATA_LOAD, 0, retaddr);
 
 #elif defined(TARGET_MIPS)
     CPUMIPSState *env = cpu->env_ptr;
     env->active_tc.PC = retaddr;
     tlb_fill(cpu, address, MMU_DATA_LOAD, 0, retaddr);
 #else
-    printf("ERROR: Unsupported architecture for panda_page_fault\n");
+    printf("\n\nnERROR: Unsupported architecture for panda_page_fault!!\n\n");
+    assert(0);
 #endif
 }