cloud9_root/src/cloud9/lib/Core/CacheSideChannel.cpp
/* Analyze memory addresses to build the constraint system */
Analyze memory addresses to build the constraint system
Analyze memory addresses to build the constraint system
void CacheChannel::processMemoryAddr(ExecutionState& state, TimingSolver* solver) {
#if 0 
	for (unsigned II = 0; II < state.memAddrs.size(); II++) {
		ref<Expr> address = state.memAddrs[II];
		if (address->getKind() == Expr::Constant) {
			ConstantExpr* CE = dyn_cast<ConstantExpr>(address);
			uint64_t addrRaw = CE->getZExtValue();
			fprintf(stdout, ".....   Address (concrete) id = %u, cache set = %llu   .....\n", II + 1, CACHE_SET(addrRaw, nset, line));
		} else {
			ref<Expr> blAddr = LShrExpr::create(address, ConstantExpr::alloc(log_base2(line), address->getWidth()));
			ref<Expr> setAddr = AndExpr::create(blAddr, ConstantExpr::alloc(nset - 1, address->getWidth()));
			for (unsigned set = 0; set < (unsigned) nset; set++) {
				ref<Expr> eqSet = EqExpr::create(setAddr, ConstantExpr::alloc(set, setAddr->getWidth()));
				bool mayBeTrue = true;
				solver->mayBeTrue(state, eqSet, mayBeTrue);
				if (set == 0)
				fprintf(stdout, ".....   Address (symbolic) id = %u, cache set = ", II + 1);
				if (mayBeTrue)
				fprintf(stdout, "%u   ", set);
				else
				fprintf(stdout, "(null)   ");
			}
			fprintf(stdout, ".....\n");
		}
	}
	return;
#endif
	fprintf(stdout, "\n\n");
	fprintf(stdout, "########## Now building the constraint system ##########\n\n");
	atomicCnstr = 0;
	fixedColdMisses = 0;
	fixedConflictMisses = 0;
	allConstraintLog.clear();
	conflictConstraintLog.clear();
	seqConstraintLog.clear();
	missConstraintLog.clear();
	coldSeqConstraintLog.clear();
	conflictConstraintLogLRU.clear();
	conflictConstraintLogFIFO.clear();
	symCacheMissLog.clear();
	symCacheMissMap.clear();
	setAssocReloadCnstrLog.clear();
	setAssocCnstrLog.clear();
	setAssocConflictCnstrLog.clear();
	missVars.clear();
	CacheChannelLRU::seqConstraintLogLRU.clear();
	CacheChannelFIFO::seqConstraintLogFIFO.clear();
	fflush(stdout);
#define __CACHE_CHECK_TIMING_LEAK
#ifdef __CACHE_CHECK_TIMING_LEAK
	if (nassoc == 1) {
		processColdMissCnstr(state, solver);
		fprintf(stdout, "\n\n########## after cold miss processing, constraint-log size %lu ##########\n\n", allConstraintLog.size());
		fflush(stdout);
	}
#endif
	processConflictMissCnstr(state, solver);
	fprintf(stdout, "\n\n########## after conflict miss processing, constraint-log size %lu ##########\n\n", seqConstraintLog.size());
	fflush(stdout);
	if (nassoc == 1) {
#define __CACHE_CHECK_SEQ_LEAK
#ifdef __CACHE_CHECK_SEQ_LEAK
		processColdMissCnstrForSeqAttack(state, solver);
		fprintf(stdout, "\n\n########## after cold miss processing, constraint-log size %lu ##########\n\n", coldSeqConstraintLog.size());
		fprintf(stdout, "########## Successfully built the constraint system ##########");
		fprintf(stdout, "\n\n");
		fflush(stdout);
#endif
	} else {
		if (strncasecmp(policy, "l", 1) == 0) CacheChannelLRU::processLRUConflictMissCnstr(state, solver);
		else if (strncasecmp(policy, "f", 1) == 0) ;
		else
		assert(0 && "fatal: replacement policy is not supported");
	}
	fprintf(stdout, "Number of symbolic cache conflicts = %lu\n", symCacheMissLog.size() + coldSeqConstraintLog.size());
	fprintf(stdout, "Number of atomic constraints = %lu\n", atomicCnstr);
	fflush(stdout);
#define __LEAK_DETECTION
#ifdef __LEAK_DETECTION
	CacheDriver::checkForAttackAndLeak(state, solver);
#endif
#define __TEST_DRIVER
#ifdef __TEST_DRIVER
	CacheTestDriver::generateAllTestBasedOnObserverModel(state, solver);
#endif
}
void CacheChannel :: processMemoryAddr ( ExecutionState & state , TimingSolver * solver ) { #if 0 for ( unsigned II = 0 ; II < state . memAddrs . size ( ) ; II ++ ) { ref < Expr > address = state . memAddrs [ II ] ; if ( address -> getKind ( ) == Expr :: Constant ) { ConstantExpr * CE = dyn_cast < ConstantExpr > ( address ) ; uint64_t addrRaw = CE -> getZExtValue ( ) ; fprintf ( stdout , " \n " , II + 1 , CACHE_SET ( addrRaw , nset , line ) ) ; } else { ref < Expr > blAddr = LShrExpr :: create ( address , ConstantExpr :: alloc ( log_base2 ( line ) , address -> getWidth ( ) ) ) ; ref < Expr > setAddr = AndExpr :: create ( blAddr , ConstantExpr :: alloc ( nset - 1 , address -> getWidth ( ) ) ) ; for ( unsigned set = 0 ; set < ( unsigned ) nset ; set ++ ) { ref < Expr > eqSet = EqExpr :: create ( setAddr , ConstantExpr :: alloc ( set , setAddr -> getWidth ( ) ) ) ; bool mayBeTrue = true ; solver -> mayBeTrue ( state , eqSet , mayBeTrue ) ; if ( set == 0 ) fprintf ( stdout , " " , II + 1 ) ; if ( mayBeTrue ) fprintf ( stdout , " " , set ) ; else fprintf ( stdout , " " ) ; } fprintf ( stdout , " \n " ) ; } } return ; #endif fprintf ( stdout , " \n \n " ) ; fprintf ( stdout , " \n \n " ) ; atomicCnstr = 0 ; fixedColdMisses = 0 ; fixedConflictMisses = 0 ; allConstraintLog . clear ( ) ; conflictConstraintLog . clear ( ) ; seqConstraintLog . clear ( ) ; missConstraintLog . clear ( ) ; coldSeqConstraintLog . clear ( ) ; conflictConstraintLogLRU . clear ( ) ; conflictConstraintLogFIFO . clear ( ) ; symCacheMissLog . clear ( ) ; symCacheMissMap . clear ( ) ; setAssocReloadCnstrLog . clear ( ) ; setAssocCnstrLog . clear ( ) ; setAssocConflictCnstrLog . clear ( ) ; missVars . clear ( ) ; CacheChannelLRU :: seqConstraintLogLRU . clear ( ) ; CacheChannelFIFO :: seqConstraintLogFIFO . clear ( ) ; fflush ( stdout ) ; #define __CACHE_CHECK_TIMING_LEAK #ifdef __CACHE_CHECK_TIMING_LEAK if ( nassoc == 1 ) { processColdMissCnstr ( state , solver ) ; fprintf ( stdout , " \n \n \n \n " , allConstraintLog . size ( ) ) ; fflush ( stdout ) ; } #endif processConflictMissCnstr ( state , solver ) ; fprintf ( stdout , " \n \n \n \n " , seqConstraintLog . size ( ) ) ; fflush ( stdout ) ; if ( nassoc == 1 ) { #define __CACHE_CHECK_SEQ_LEAK #ifdef __CACHE_CHECK_SEQ_LEAK processColdMissCnstrForSeqAttack ( state , solver ) ; fprintf ( stdout , " \n \n \n \n " , coldSeqConstraintLog . size ( ) ) ; fprintf ( stdout , " " ) ; fprintf ( stdout , " \n \n " ) ; fflush ( stdout ) ; #endif } else { if ( strncasecmp ( policy , " " , 1 ) == 0 ) CacheChannelLRU :: processLRUConflictMissCnstr ( state , solver ) ; else if ( strncasecmp ( policy , " " , 1 ) == 0 ) ; else assert ( 0 && " " ) ; } fprintf ( stdout , " \n " , symCacheMissLog . size ( ) + coldSeqConstraintLog . size ( ) ) ; fprintf ( stdout , " \n " , atomicCnstr ) ; fflush ( stdout ) ; #define __LEAK_DETECTION #ifdef __LEAK_DETECTION CacheDriver :: checkForAttackAndLeak ( state , solver ) ; #endif #define __TEST_DRIVER #ifdef __TEST_DRIVER CacheTestDriver :: generateAllTestBasedOnObserverModel ( state , solver ) ; #endif }
Analyze memory addresses to build the constraint system
Analyze memory addresses to build the constraint system
/* for testing */ /* clean up tasks before processing each execution state */ //	fprintf(stdout, "\n\n########## after path processing, constraint size %lu ##########\n\n", state.forks); /**
	 * process cold miss constraints
	 * a crude approximation is to remove all cold-miss related constraints
	 * this will derive a bound on the number of eviction misses and a loose interval
	 * on total number of misses ---> [e+1, e+|set|]
	 */  // Daniel. /* for direct-mapped caches */ /* process conflict miss constraints */ /* for direct-mapped caches */  // Daniel. /* generate cold-miss constraints for detecting leaks in sequence-based attacks */ /* for set associative caches */ /* do nothing, FIFO is processed _online_ -- while building constraints */  // Daniel. /* entry level routine to detect information leak in a given execution */  // Daniel. /* entry level routine to generate tests for each possible side-channel observation */