[haiku-development] Re: UEFI: gRuntimeLoader function pointers wrong

  • From: Ingo Weinhold <ingo_weinhold@xxxxxx>
  • To: haiku-development@xxxxxxxxxxxxx
  • Date: Sat, 10 Dec 2016 00:18:38 +0100

On 12/09/2016 10:51 AM, Jessica Hamilton wrote:

So, finally figured out why the page faults are happening...

In my debugging, I've found that gRuntimeLoader->test_executable ends
up pointing to the function from another process/address space. This
is all from debug output I've added in src/system/libroot/os/image.cpp
(and some other debug output in
src/system/runtime_loader/elf.cpp:inject_runtime_loader_api).

Essentially, what happens is we have launch_daemon with the following addresses:
   __gRuntimeLoader @ 0x00000210f0eafa60
   __gRuntimeLoader->test_executable @ 0x00000210f0ca39d0

Then later on, another process (probably bash in this example):
   __gRuntimeLoader @ 0x000000b72af67a60
   __gRuntimeLoader->test_executable @ 0x000000b72ad5b9d0

Not sure which process this is at this point, but we have in
__test_executable():
   __gRuntimeLoader @ 0x210f0eafa60
   __gRuntimeLoader->test_executable @ 0xb72ad5b9d0

And then we get a page fault...

At this point, I'm stumped as to how this is even happening. I don't
know what to even look at; it's not like test_executable (and other
pointers) get explicitly set anywhere; so pretty damn stumped :(

As Fredrik already pointed out, the different load addresses are due to ASLR. It may or may not be useful to disable it to get reproducible results.

For debugging early userland crashes I'd recommend panic()ing in vm_page_fault() (turn dprintf() into panic() [1]). This way you have at least the kernel debugging facilities at your disposal to inspect the crashed team.

I haven't tried that yet, but in theory it should also be possible to write a core dump [2] at that point. You'll need Haiku's Debugger to analyze it -- the format is only marginally compatible with Linux/BSD core dumps.

CU, Ingo

[1] http://cgit.haiku-os.org/haiku/tree/src/system/kernel/vm/vm.cpp?id=19d8d9fa3983e6687caeab8fe1193861a5202ab6#n4283
[2] http://cgit.haiku-os.org/haiku/tree/headers/private/kernel/core_dump.h?id=19d8d9fa3983e6687caeab8fe1193861a5202ab6#n14


Other related posts: