2

What are the steps that the Linux kernel does whenever the hardware raises segfault. Right now I know that through the IDT, the fault handler handles it, and somewhere along the road there is a message in the kern.log (dmesg) about the fault.

I am asking this question because I am developing an hypervisor, and whenever there is a segfault in user space (which should`nt crash the system), the system crashes (the crash happens only after the message in the kern.log). So if I could retrace what the kernel does whenever it encounters segfault it will help me a lot.

Improve this question
2
  • Does you hypervisor run on Linux, or is Linux the guest system? What exactly crashes?
    – RalfFriedl
    May 2, 2019 at 4:59
  • @RalfFriedl it's a thin hypervisor, so it runs from Linux and make it the guest. The whole setup runs on VMware player, and the whole setup crashes. So somehow the segfault make the hypervisor enters a buggy state, that's why I want to understand what's the process of segfault.
    – dmg
    May 2, 2019 at 5:10

2 Answers 2

Reset to default
4
  1. arch/x86/kernel/idt.c:152 - page_fault is used in the IDT
  2. arch/x86/entry/entry_64.S:1143 - page_fault is defined as a wrapper function for do_page_fault(), implemented using the macro idtentry
  3. arch/x86/entry/entry_64.S:847 - idtentry macro
  4. arch/x86/mm/fault.c:1562 - do_page_fault()

Once you reach do_page_fault(), you should see clickable links to navigate the rest of the code. You can't do that for these first four steps, because Elixir doesn't understand the macro magic. It also doesn't understand assembly.

If you need to look at any other traps, some of the other handler functions (do_*) are in turn defined by another macro, x86/kernel/traps.c:281 DO_ERROR().

The function that logs the segfault message is also in fault.c: show_signal_msg(). A little freebie for you. Elixir doesn't allow searching for strings in general, only identifiers. GitHub also shut down their code search. In any case it's hard to search for this message format string without actually downloading the source code, because "%s%s[%d]: segfault at %lx ip %px sp %px error %lx" does not contain a lot of specific words or phrases :-).

The above links are to specific line numbers of the v5.0 source code. Using Elixir, which I really like :-).

Improve this answer
2
  • 1
    The question doesn't mention Elixir at all though?
    – Will
    May 2, 2019 at 10:58
  • @Will but I like it, and this answer says you need to click through the links anyway, which will tell you what Elixir is :-). A bit of suspense for you.
    – sourcejedi
    May 2, 2019 at 10:59
1

The user space is managed and run by the kernel, and thus if a kernel level segfault occur inside the user space it will affect the kernel.

Each system will behave differently according to the log setup, the kernel setup and whether it's using systemd or not (but dmesg is commonly the main debugging/log location)

In your particular situation if you know what process generate the segfault you use strace or gdb appname to debug the problematic process.

https://wiki.archlinux.org/index.php/Step-by-step_debugging_guide this guide have more details about how to debug a segfault

Improve this answer
1
  • As I staated the seg fault occurs at the user space, and I actually raise it on purpose. The thing I am trying to debug is how the default crashes the system through error in a different part of my code, aka the hypervisor. That's why I try to understand what Linux do when segfault .
    – dmg
    May 2, 2019 at 14:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .