#Nyaux
1 messages ยท Page 13 of 1
this is the address mlibc just mmaped
idk you go and check
Because you fucked it up
do info mem
missing 2 zeroes?
no write?
oh im stupid
Bro mapped it read-only
Mlibc pronouns is he him confirmed
i have syscalls
yeah
lol
no
Lol
you'll need that
I removed it
just do if fd < 3
If fd โค๏ธ
Speedrun dead
that could lead to funny bugs tho
write(-1, "hello")
lol
Thats an unsigned number tho
.so.8 is a symlink
Bro is fucked
Just read linked file and follow it
Its just a path
the symlink just contains the path to the actual file
in ascii?
No, in utf-256
holy
nah
Lmao
Octal encoded endiannes
at least make it page aligned smh they should make it utf-${pagesize_of_the_system} because portability is for cowards
symlinks have their own file type
Its just one other file type
it is a symlink
a hard link is indistinguishable from a regular file (because every regular file is already a hard link)
This is just ls showing you the resolved path I think
yeah
okay this check is failing
tf???
oh wait
tried reading the data out of a symlink
clearly thats not
proper
do symlinks have file size
in tar
it's a symlink
it may not be i think
the size of the file is zero
the US government or somethin
ustar my butt
that's why it's called UStar
star into the butt
no i think it's 0 terminated lol
uhm akshually it's unix standard tar
bru
you see i spread 2 misinformation
that's 2 rubles deposited to my bank account
ah i see
right forgot null terminator
strlen + 1
BRO
hZ
bRO
can u be normal for once and write normally to my file
THERE WE GO
THERE WE FUCKIN GO
will symlinks be absolute paths?
like all the time?
i suppose they would be?
symlinks can be relative
in which case they're relative to where the symlink is
it might be a bit problematic with how you created the tar archive but ig you could just prepend a / to the symlink path
no
all symlinks are relative
to the location of the symlink
oka
oh huh my bad
Symbolic links are interpreted at run time as if the contents of the link had been substituted into the path being followed to find a file or directory.
from man 2 symlink
istr symlinks with an abs path but i can't find any examples on my system :^)
you know what, i had expected that too
hm no i do have absolute symlinks on my system
well yeah if a path starts with a /...
yeah but the wording implies that it just takes the contents and plops them straight into the path being resolved
why bro 
bro
how tf do i debug this
its clearly resolving the path
and its giving the vnode
so like
why tf

there is a logging option that will tell you a bit more
how to enable
no i mean
how to enable this option
what do i do
oh wait
its a bool
yea trying to find
then it had tried to read
why is it failing on the read
does it even succeed to open the file?
it must've, it looks like its reading the elf ehdr
it has a check
judging by the buf print
i guess you may try to open that file yourself in the kernel to see what happens, without relying on mlibc
ill try printing some of the file data

ummm
ptr->type == NYAVNODE_SYMLINK is failing so
wtf
oh
its giving me back a directory
oh...
what am i supposed to do in this case
if it resolves to a directory
???
if the symlink resolves to a directory like
what am i supposed to do exactly
cause its resolving to /usr/lib/bash
bru
yea and mlibc is trying to read the directory
???
like wha
that is just wrong though
how
libstdc++ resolving to /usr/lib/terminfo makes no fucking sense
neither does anything else there
you tell me
nah, the tarball is fine
i trust GNU tar and i use the same script to generate tarballs and they generate fine
that's how i know
lemme extract the stuff and see
but you can unpack and check for yourself
yeah
it's initramfs.tar, go to a different dir and run tar -xf <path to>/initramfs.tar
bro im dying

why is that happening
why tf
what da helll
missing null terminator

OK I FIXED IT
nice cool
it's really simple
it's used to set FS basically
which is used for thread local stuff
but the sysdep is essentially just wanting you to do FS = arg
if you want, you can use wrfsbase to write the fs base
instead of adding a syscall
yes but this is yet another microoptimisation and requires CPU support since that's not baseline
i would say just do a normal syscall and set it normally
idk what ended up with him and deciding to ensure wrfsbase is supported
and failing otherwise
yes
well of course your scheduler needs to save and restore FS properly
if it doesn't already
cool
make sure you're not for some reason leaking kernel pointers to userland and expect it to be able to access them fine
if that is a page fault with that cr2, it suggests that's what's going on
you don't have KASLR on do you?
yeah you have it off
else the address would be different each time
bro wtf
now its not resolving symlinsk
what
the
fuck
it just decided
to end its life
and stop resolving the symlinks
man i hate this
uh huh
bro
someone is modifying
my shit
and making my vnode
type
file
wtf
my kernel is cursed my kernel is cursed my kernel is cursed my kernel is cursed
does the fucking compiler not see this line
notneeded->type = NYAVNODE_SYMLINK
im done
im done
its not evening trying to resolve a symlink
its the heckin
sys_read
uh huh
okay i found that issue
it was the prepending
CLEARLY VALID FILE DATA
LIKE BRO
THE MEMCPY GOES FINE
like wtf
WHAT IS MLIBC DOING
HM?
???
seriously where is this address coming from

WHERE
after further debugging it seems to be happening in the actual bash executable itself
tho i cannot addr2line it
or no
its not happening in bash
i dont know actually
cpl was 3 when this page fault happens
heres what we do know, the address is not something canoical at all. kernel never uses this memory so it cannot be a leak
i cannot addr2line this rip anywhere
cannot find in gdb
im very confused honestlyl
we'll sort it out later
like every bug you've hit before, they all seem silly in retrospect
but i need to sort it out now

ill print every syscall mlibc makes
okay very last thing mlibc does
syscall_fs
mmap is giving valid addresses
looks valid
yea fs base is fine too
so wtf is going on
bro
i dont see any type of memory leak
in all the addresses syscall_mmap
all userspace addresses
i have no fucking idea
what is the instruction at rip
i cant addr2line it
yes you can
try harder
bru
before the fault
it likes does something for a few seconds no logging
then it faults
lol fun
you will !!!!
log all the functions it's trying to run
you can modify the mlibc source code
add some prints
log the function pointers
figure out which one makes it die
use gdb
figure out what exactly makes it die
you can put a breakpoint on it before jumping to userspace
then (void*)...
uh huh
use objdump
and look for the last 4-5 nibbles
also look where libc.so is loaded lol
its not gonna be loaded at 0x40000000
that's the ld.so is loaded
logBaseAddresses should be good
that is fineโข๏ธ iirc
okay so
wtf is going on

this is fucking pain to debug
ill try breakpointing 0x4121abb0
no idea i dont have your os built
i cant test it myself
hard to do remote debugging
just build it 
if i wanted to debug userspace i would just bring back my old zigux code
im gonna have to at some point
zeroes!
add %al, (%rax)
0000
funny
idk maybe ur not reading in the library file into memory correctly
idk lol
also on that note, where tf are open+read calls?
i didnt see any in the syscall log you showed earlier
heres the full log
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
show seek implementation
kk
void syscall_seek(struct syscall_frame *frame, struct per_thread_cpu_info_t *ptr)
{
kprintf("syscall_seek()\n");
int fd = frame->rsi;
int offset = frame->rdx;
int flag = frame->r10;
struct process_info *pro = get_cur_process_info();
struct FileDescriptor *d = &pro->Descriptors[fd];
switch (flag)
{
case 0:
if (d)
{
d->offset = offset;
frame->rdx = 0;
frame->rax = d->offset;
return;
}
else
{
frame->rdx = -1;
return;
}
break;
case 1:
if (d)
{
d->offset = d->offset + offset;
frame->rdx = 0;
frame->rax = d->offset;
return;
}
else
{
frame->rdx = -1;
return;
}
break;
case 2:
if (d)
{
d->offset = d->ptr->ops->v_filesz(d->ptr) + offset;
frame->rdx = 0;
frame->rax = d->offset;
return;
}
else
{
frame->rdx = -1;
return;
}
break;
default:
kprintf("%d\n", flag);
kprintf("Flags are wrong?\n");
frame->rdx = -1;
return;
break;
}
}
ye
one "problem" i see is that v_filesz returns a size_t and idk how adding a negative int would work with that?
okay then ill cast the size_t into an int
it seems to work, nvm
you can double check that the initArray pointer actually points to the correct place by logging it and checking the elf file with readelf -d
oka
okay lets readelf
yea its correct
0xbf000
bro

this is clearly not a silly bug
inb4 it's vmm shenanigans
Well if it's memory being zeroed without anything telling it to be zeroed
Try setting hardware watchpoints on the affected address
Using the debug registers
Or fill in newly allocated addresses with some constant like 0xCC
i zero all memory
Then if you jump to some bogus address that happens to be allocated nut untouched, instead of getting a bunch of add instructions, you'll get int3
Try memsetting memory to 0xCC
And see if anything changes
ok
In the vmm of course
okay 0xCC
If it is you jumping to uninitialized memory, you'll break using int3 instead of going to some random rip
int3?
breakpoint
You know the int instruction
int3 is a shorthand for that
okay so somewhere, do int3
yes
so instead of executing 00000000
you execute CCCCCCC
which is int3
and not some random add [rax], al
Probably mlibc not zeroing memory on its own
that is very possible
bru
why
so itll just cause a page fault when it tries to execute the page
Yeah
If it tries to jump to a bogus address
You'll need prot flags in some way for this to work
okay fine
You can't just set any page that should be executable to XD
isnt the xd bit the last bit in the entry
Bit 63
But it's technically not guaranteed to be supported or enabled
Limine enables it
But it's only unsupported on old cpus
i prefer NX because XD makes me laugh (im mentally 12)
shift overflow
yep that too
how
Check some bit of EFER to see if XD is enabled
1 is of type int
okay then cast to uint64
okay and now i check prot if its executable
i think unsigned long is 64 bits on 64 bits
if its executble no xd
except if its windows
but windows is weird anyways
llp64 
At least you shouldn't expect any destructive compiler optimizations
pe+ kernel
Don't forget to make PE compatible bootloader
Just use the windows loader
Or any new C features any time soon
yea it should be fun, especially given that link.exe can link efi applications :^)
whats the bitmask for prot_exec
so i can technically write it all and compile using windows tooling
i should use msbuild if i want it all to be extra shit
Iirc you define these bits yourself
no?
you have to conform whatever abi you use in mlibc tho (well you can still make your own abi but if you use one of the existing ones then you have to use the constants from that)
im using the one copied by vinix
most default sysdeps use linux abi now

probably linux abi then
okay found
you could probably convince limine to load that
or just use kernelcaches :^)
good job
just realized
well no
oh wait is he accepting flags as uint8_t
yes
yea just changed types
no page fault?

still err=4
bru
does qemu have xd bit support disabled
no
weird
yea um
it maps some memory to not be executabl
to which
i do no problem
err still = 4
bru

bro like what the actual fuck
is going on

this is pain
mlibc just doesnt want me going to bash
there is a >95% chance it is not mlibc's fault 
this is hell
bro
he aint wrong tho
what is the exact problem?
mlibc is jumping to some bogus address
even tho all memory i give to mlibc is 0'd and correct and valid addresses
how bogus are we talking? something truly unforgivable like 0xc2ba349d66? or a slightly bogus address, like 0x430582
this
jumping to a bunch of instructions that literarly just
dont make sense
also all data using sys_read thats read into the buffer seems valid
this is the full log
i want you to check whether that address seems to be legitimate with respect to bash (it looks like if bash is loaded at 0x40000 then that could be within it?)
i believe its with libc.so
not bash
in which
the init array
is correct, bf000
could it be init_arraysz
its valid
no
wtf is going on

@unkempt relic do u have any idea whats going on
those larger addresses do look like library addresses but the one that was closer to 0x40'000, which i believe is what you said was a problem, that one looks more bash to me
have you inserted a print after the DT_INIT_ARRAYs are all invoked?
i will do that
because if we know that the problem is within one of the INIT_ARRAY functions then that is useful information
it seems to be within one of the init_array functions
otherwise rtld would have printed complete
so this is within libc.so
this is the instruction
here
are you single-core?
yes
why???
i want to see what happens if you don't touch FPU state in the kernel at all
oka
keep SSE on you've only got one process that deals with it
then we can be assured your FPU state management is not to blame for this
yep
(that's the only reason i asked, it got rid of one degree of freedom)
this line
let's find out where and why control jumps to this address
step through in GDB, instruction-by-instruction if necessary, until it jumps to the funny address
okay
then it jumps here
to which it jumps here
more instructions
jumps here
now here
this is the instruction
that makes it jump to a funny address
0x491aa6
to these very invalid instructions
here
this new_set instruction
which is a macro
what do u think is happening @unkempt relic ?
when did it get to 0x49xxxx?
i am unsure, i will run gdb again and see
this instruction
which makes it jump here
this instruction
is before it jumps to 0x49xxxx
here
what tf is going on

any ideas?
but that's not right
i know
you're sure that if you stepi when on this instruction, it jumps to 0x49xxxx?
i used si
yes
this is very weird
i have no further ideas on how to debug this further
kindly p /x 0x412bffb0
alr
this is the value
dereferencing the data gives
is that wrong @unkempt relic ?
it's as expected
you could set a watchpoint in that address if you want
btw if you use add-symbol-file -o 0xloadaddress path/to/loaded/file you can see where you are in it in GDB
how
watch (void*)0xaddress (you'd want to do it early on and see where it's getting changed, add-symobl-file helps)
clearly
nothing is modifying that address
so i do not know whats going on
hmmm??
it's where it was changed to 0x491a80 that interests me more
here?
now bt
case R_X86_64_IRELATIVE: {
auto ptr = object->baseAddress + addend;
auto target = reinterpret_cast<uintptr_t (*)(void)>(ptr)();
*((uintptr_t *)rel_addr) = target;
break;
}
that's the relevant lines in mlibc (assuming you are using mlbic master or that the line numbers haven't changed much)
the question is why libc.so would want to jump to that address
i do not know
maybe the people behind mlibc would know
does anyone know?
this is truly confusing
im stuck

does no one have any idea whats going on
please anyone
๐
Inb4 rewrite 2 of Nyaux
no
could you regenerate the mlibc patch and push?
ok
patches are already pushed
ah yeah, I just had to delete the mlibc dirs to get them to update
I can't really figure out anything either, it just goes to some completely different code that is certainly not within the libc from the jump in getenv<plt>
i know
if u do find the issue @molten grotto let me know, im going sleep
does bash provide a getenv?
actually yes it looks to be overwriting it
that would explain why it jumps there but idk why doesn't it show that address in gdb
I think this is some sort of memory bug as eg. 0x47fffc has a valid instruction from the bash executable but if you look at what there is when it dies there is just garbage there
maybe the vmm is giving back that address cause of mmap_range
which doesnt create a region to mark that memory range as allocated
yeah looks like sys_mmap is indeed giving the same address where the executable is loaded because you don't ever mark it as used (and you don't use mmap_range there either)
so yeah you want to create a region when you load an elf that spans the range it uses (the first PT_LOAD phdr's pt_vaddr is always the start and the last PT_LOAD's pt_vaddr + pt_memsz is the end as they are ordered by the vaddr field)
i will modify that when im not sick
right now im too weak to do anything
i feel like i might collapse my entire body hurts
sorry im a little confused
but modify mmap range to create an allocated region correct?
I mean yeah you probably want that too, but you don't use mmap_range in the elf code
why?
idk, you just don't
you could
I don't think you had mmap_range when you wrote the loading code
also MAP_FIXED actually does funny stuff like if there already is an allocated region that contains the range it tries to map using that flag then it splits the already existing region into different parts (possibly one from the start of the old region before the region range mapped with MAP_FIXED, one for the actual region range and then possibly one for the region from that range to the end of the old region)
wha
if you MAP_FIXED over an existing mapping it replaces that part of the existing mapping
that is the intended behavior
i will just not use mmap range
for what it's worth you shouldn't have to worry too much about supporting MAP_FIXED yet, i didn't need it for mlibc loading, but of course you've got to make sure you don't allocate the areas that mlibc wants to map DSOs into
But mlibc tries to map fixed
i meant to say MAP_FIXED over existing mappings
Oh you mean that aspect of it
i do not understand
the ability to replace existing mappings detailed above
btw if it turns out you are giving out memory that was already mapped then that makes good sense
with regar dto the problems you experienced earlier
yes
that's zero
if you zero pages when you give them out then there's a working hypothesis on what's going wrong
that is what i do
the answer is simple then
make sure not to give out memory that was already mapped when mlibc has asked you to map some anonymous memory anywhere
i think its because i do mmap_range in the elf loader
to whihc
doesnt mark the region as allocated
and thus it gets intruded on
yes
then make sure it's marked allocated so it's not given out again
i am not familiar with your kernel design
if the stack is loaded up there and your allocator allocaets from low addresses before high then it shouldn't be intruded on for a while
yes my allocator does low addresses before high
this is what i shall do
even marking it as allocated
still the same issue
wait
i know
ummm
great
clearly this didnt solve it
struct vmm_region *cur_node = maps->head;
struct vmm_region *prev_node = NULL;
uint64_t f = align_down(base + phdr.p_vaddr, 4096);
while (cur_node != NULL)
{
if (prev_node == NULL)
{
prev_node = cur_node;
cur_node = cur_node->next;
continue;
}
if ((cur_node->base) > f && (prev_node->base + prev_node->length) < f)
{
struct vmm_region *new_guy = kmalloc(sizeof(struct vmm_region));
new_guy->base = f;
new_guy->length = (align_up(phdr.p_memsz + misaligned, 4096));
kprintf("done\n");
prev_node->next = new_guy;
new_guy->next = cur_node;
cur_node = cur_node->next;
goto done;
}
else
{
// not enough space for our new region sadly, continue
prev_node = cur_node;
cur_node = cur_node->next;
continue;
}
}
done:
what i do
nyaux rewrite /j
you could watch the 0'd address and see what happens
see whether it's supposed to be 0'd or not
if i were debugging it first i would objdump bash and check the address looks like there should be code at it
did you change the code to mark the region where the elf is loaded at as allocated? because I am 99% sure thats the issue
i think he said he did, i'm not sure
yep
you can see on the github @molten grotto that i clearly do that https://github.com/rayanmargham/Nyaux/blob/master/kernel/src/elf/elf.c
I feel like it's a scheduler problem
how
still same issue
I don't think that code is right
how
well for an example if there is no previous node you set current node to the next node and continue when you should put the new node at the head if you want to keep them ordered and you don't really care if the prev node base + prev node size is less than the base if they are ordered (well you could still do <= if you wanted as the end is exclusive)
im trying to keep them ordered, and there is always a node in a pagemaps region
always at least 2
that is correct, for an example if the base is 0xFF0 and the length is 0x20 if you just align 0x20 to a page size you are going to get one page when in reality you must allocate two because the base isn't aligned
see new_pagemap() in vmm.c
the points that I said still apply
i am confused then
like
i dont get what is the issue with this
well for an example if there is no previous node you set current node to the next node and continue
then they aren't going to be properly ordered
for an example if head's base is 0x50000 and the node's that you are trying to insert is 0x40000
ah, in that case there is only the issue with using < instead of <=
where am i doing <=?
you don't and thats the issue
oh okay
something like this i suppose
OH MY FUCKIN GOD
OH MY
FUCK
IN
GOD
THANK U QWINCI
yes as eg. if previous base is 0x40000, previous length is 0xFFF and you are trying to insert a node at 0x40FFF it doesn't work
yea i get u
likely it uses pthread mutex and that needs it
well im happy we are closer to bash now
pthread mutex?
i dont have locks in my kernel so
do i just do nothing?
happens
return ENOSYS from futex_wait/futex_wake
u should be able to get further
bash shouldnt need them
you can just make that return 0 if your OS is singlethreaded
mlibc uses locks internally by default
but if you don't have multithreading it's not needed
I was right #1230349543623757845 message
sorry guys im just
not having a good time rn
kinda hard to work on the project when some things happening irl
i do want to work on it tho
i rlly do feel a passion for this project
just guess that this whole skipping school and everything just to work all day on nyaux is just not sustainable anymore
yeah that's probably a good call
but you can just work on it without skipping on the rest, just partition your time better
kinda difficult to work on it all together when i have final exams next week
โ ๏ธ
fair lmao
prioritise your finals for now
alr
also yk u could probs get to userspace faster then me, if u knew exactly what u were doing probs under 24 hours
thats if u knew EXACTLY of what u were doing
but this was a from scratch kernel for me without any previous knowledge so ๐
random thought
hmm

why is mlibc trying to write to fd 2
stderr
lmao
clearly bash is looking for things ig
now what is sys_dup
i have no fuckin idea
!!
return a new file descriptor referring to the same open file description
but why
and also
ill have to make a new file descriptor that points to the same vnode
as i dont have that extra level of indirection
did u recompile bash with mlibc?
ah I see
what the heck is F_DUPFD?
ok
oh bash didnt care that i errored out for sys_dup
it just continued ig
but now it wants fuckin
sys_tcgetattr
why

probably to set up raw mode on the tty for readline
it's configuring the terminal to disable line buffering and echo
since readline provides line editing on it's own
do i just return -1
as i dont have a tty
im just writing everything directly to flanterm
not sure how well it'll take tcgetattr/tcsetattr failing
well what else am i supposed to do huh
yea it didnt give a shit
now it wants sys_ppoll
which ill return -1
are you still ignoring fd 2?
well ig since poll fails, there's no way for it to get input
since bash does poll(stdin fd) => poll completes => read(stdin)
okay then what should i do
any bash prompt printed at all? did you implement isatty?
if bash thinks stdin is not a tty it will quit
is a tty just returns 0
because if stdin is not a tty then bash must be being used not as an interactive shell, but rather to run a script
it'll still read it but in non-interactive mode
i think that's what mlibc expects for a tty
ig
yeah iirc ENOTTY is expected for not a tty?
that's the one i think
mr @elder shoal promised me this would be easy 
small amount of syscalls doesn't mean you don't need to implement their functionality properly :^)
i did tho for the syscalls he listed
he didnt include all these other syscalls
now bash wants poll
what am i supposed to return
this is the tricky part of mlibc
I didnt cuz I had just stubbed them lol
it's so featureful that sometimes it gives you too much
but i think you can literally have poll just return ENOSYS and bash should happily deal
Yeah