<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=koi8-r">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div dir="ltr" style="font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255); font-family:calibri,arial,helvetica,sans-serif">
<div style="color:rgb(33,33,33)">
<div>
<div><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">>T</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">hat address seems to come from >here: </span><a href="https://github.com/torvalds/linux/blob/5924bbecd0267d87c24110cbe2041b5075173a25/arch/x86/boot/pm.c#L124" title="https://github.com/torvalds/linux/blob/5924bbecd0267d87c24110cbe2041b5075173a25/arch/x86/boot/pm.c#L124
Ctrl+ щелчок: перейти по ссылке" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">https://github.com/torvalds/linux/blob/5924bbecd0267d87c24110cbe2041b5075173a25/arch/x86/boot/pm.c#L124</a><br>
</div>
</div>
</div>
</div>
<div style="color:rgb(33,33,33)">> </div>
<div style="color:rgb(33,33,33)">>```</div>
<div style="color:rgb(33,33,33)">
<div><span class="gmail-Apple-tab-span" style="white-space:pre"></span>>protected_mode_jump(boot_params.hdr.code32_start,</div>
<div><span class="gmail-Apple-tab-span" style="white-space:pre"></span>> (u32)&boot_params + (ds() << 4));</div>
</div>
<div style="color:rgb(33,33,33)">>```<br>
</div>
<div style="color:rgb(33,33,33)">> </div>
<div style="color:rgb(33,33,33)">>That boot_params.hdr.code32_start field is probably either invalid (bad reloc or something else causing the bootloader to >calculate the wrong address) or valid but the thing it thinks it is pointing to wasn't loaded (missing
PT_LOAD etc.). <br>
</div>
<div style="color:rgb(33,33,33)"><br>
</div>
<div style="color:rgb(33,33,33)"><span style="color: rgb(33, 33, 33); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">boot_params.hdr.code32_start field</span> is valid :) It is 0x100000, like expected
(btw thanks for those links on info how kernel boots, they were pretty useful). I checked it is valid using trace:<br>
</div>
<div style="color:rgb(33,33,33)"><br>
</div>
<div style="color:rgb(33,33,33)">
<div>void go_to_protected_mode(void)</div>
<div>{</div>
<div>if (boot_params.hdr.code32_start == 0x100000)</div>
<div> puts("go_to_protected_mode 1\n");</div>
<div>else<br>
</div>
<div> puts("go_to_protected_mode 2\n");<br>
</div>
<div>while (1) {};<br>
</div>
<br>
</div>
<div style="color:rgb(33,33,33)">I had to use infinite loop here, because QEMU does not crash for me, but do domething what looks like reboot and clears all my traces output. Infinite loop helps to see traces text, if placed before dead point.<br>
</div>
<div style="color:rgb(33,33,33)"><br>
</div>
<div style="color:rgb(33,33,33)">><br>
</div>
<div style="color:rgb(33,33,33)">>Btw, how did you narrow it down to that specific instruction? That's pretty handy.<br>
</div>
<div style="color:rgb(33,33,33)"><br>
</div>
<div style="color:rgb(33,33,33)">I used very simple approach, did not know how to do that properly :), so <span style="font-size: 12pt;">inserted infinite loops in asm code:</span></div>
<div style="color:rgb(33,33,33)">foo:<br>
</div>
<div style="color:rgb(33,33,33)"> jmp foo<br>
</div>
<div style="color:rgb(33,33,33)"><br>
</div>
<div style="color:rgb(33,33,33)">And watched for behavior of QEMU. If it just hanged that was fine, I knew I am inside my loop, if QEMU rebooted, I knew it crashed at point I was looking for. So tracing bfd linked kernel and using documentation I found that <span style="color: rgb(33, 33, 33); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">startup_64 </span>is
next destination POI, and found that this instruction is the last before QEMU reboots for me.<br>
</div>
<div style="color:rgb(33,33,33)"> <br>
</div>
<div style="color:rgb(33,33,33)">>I think you can also get DSO with -pie I think, but I don't see that either. This is quite mysterious. I also did a quick look at the >linker script and didn't see anything at first glance that would cause DSO output (can linker
scripts even control EType?). The >bootloader might not even look at the EType though.</div>
<div style="color:rgb(33,33,33)">> </div>
<div style="color:rgb(33,33,33)">>-- Sean Silva</div>
<div style="color:rgb(33,33,33)"><br>
I think best way would be to look at what is invocation for BFD here. I am pretty sure -shared/-pie flag is just lost because of some configuration issue, probably it checks that we are running bfd may be. Just a guess.<br>
</div>
<div style="color:rgb(33,33,33)"><br>
</div>
<div style="color:rgb(33,33,33)">George.<br>
</div>
</div>
<br>
<br>
</div>
</div>
</div>
</body>
</html>