improve API to allow triple lockstep schemes

usbarmory · Oct 30, 2024 · e43b24e · e43b24e
1 parent e5acae8
commit e43b24e
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 14 deletions.
diff --git a/monitor/exec_arm.go b/monitor/exec_arm.go
@@ -183,7 +183,11 @@ func (ctx *ExecCtx) Mode() (current int, saved int) {
 	return
 }
 
-func (ctx *ExecCtx) schedule() (err error) {
+// Schedule runs the execution context until an exception is caught.
+//
+// Unlike Run() the function does not invoke the context Handler(), there
+// exceptions and system or monitor calls are not handled.
+func (ctx *ExecCtx) Schedule() (err error) {
 	mux.Lock()
 	defer mux.Unlock()
 
@@ -236,12 +240,12 @@ func (ctx *ExecCtx) Run() (err error) {
 	}
 
 	for ctx.run {
-		if err = ctx.schedule(); err != nil {
+		if err = ctx.Schedule(); err != nil {
 			break
 		}
 
 		if ctx.Shadow != nil {
-			if err = ctx.Shadow.lockstep(); err != nil {
+			if err = ctx.Shadow.lockstep(ctx); err != nil {
 				break
 			}
 		}

diff --git a/monitor/exec_lockstep.go b/monitor/exec_lockstep.go
@@ -10,32 +10,32 @@ import (
 	"errors"
 )
 
+// castShadow builds a shadow execution context suitable for lockstep()
 func (ctx *ExecCtx) castShadow() *ExecCtx {
 	shadow := *ctx
 	shadow.Handler = nil
-	shadow.Shadow = ctx
 
 	return &shadow
 }
 
 // lockstep runs a shadow execution context for a single scheduling cycle, an
 // error is raised when the resulting state differs from the primary execution
 // context.
-func (ctx *ExecCtx) lockstep() (err error) {
-	ctx.Lockstep(true)
-	defer ctx.Lockstep(false)
+func (shadow *ExecCtx) lockstep(primary *ExecCtx) (err error) {
+	shadow.Lockstep(true)
+	defer shadow.Lockstep(false)
 
-	if err = ctx.schedule(); err != nil {
+	if err = shadow.Schedule(); err != nil {
 		return
 	}
 
-	if ctx.Handler != nil {
-		if err = ctx.Handler(ctx); err != nil {
+	if shadow.Handler != nil {
+		if err = shadow.Handler(primary); err != nil {
 			return
 		}
 	}
 
-	if !Equal(ctx, ctx.Shadow) {
+	if !Equal(primary, shadow) {
 		return errors.New("lockstep failure")
 	}
 

diff --git a/monitor/exec_riscv64.go b/monitor/exec_riscv64.go
@@ -175,7 +175,11 @@ func (ctx *ExecCtx) Cause() (code uint64, irq bool) {
 	return
 }
 
-func (ctx *ExecCtx) schedule() (err error) {
+// Schedule runs the execution context until an exception is caught.
+//
+// Unlike Run() the function does not invoke the context Handler(), there
+// exceptions and system or monitor calls are not handled.
+func (ctx *ExecCtx) Schedule() (err error) {
 	var pmpEntry int
 
 	mux.Lock()
@@ -227,12 +231,12 @@ func (ctx *ExecCtx) Run() (err error) {
 	}
 
 	for ctx.run {
-		if err = ctx.schedule(); err != nil {
+		if err = ctx.Schedule(); err != nil {
 			break
 		}
 
 		if ctx.Shadow != nil {
-			if err = ctx.Shadow.lockstep(); err != nil {
+			if err = ctx.Shadow.lockstep(ctx); err != nil {
 				break
 			}
 		}

diff --git a/monitor/exec_stub.go b/monitor/exec_stub.go
@@ -48,6 +48,12 @@ func (ctx *ExecCtx) Cause() (code uint64, irq bool)
 // Mode (ARM) returns the processor mode.
 func (ctx *ExecCtx) Mode() (current int, saved int)
 
+// Schedule runs the execution context until an exception is caught.
+//
+// Unlike Run() the function does not invoke the context Handler(), there
+// exceptions and system or monitor calls are not handled.
+func (ctx *ExecCtx) Schedule() (err error) {
+
 // Run starts the execution context and handles system or monitor calls. The
 // execution yields back to the invoking Go runtime only when exceptions are
 // caught.