Persist guest ELF entry point for crashdump AT_ENTRY

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>

Author: ludfjig

src/hyperlight_host/src/hypervisor/hyperlight_vm/mod.rs

@@ -575,6 +575,13 @@ impl HyperlightVm {
         self.next_action = next_action
     }
 
+    /// Set the guest ELF entry point used to fill `AT_ENTRY` in
+    /// crashdumps.
+    #[cfg(crashdump)]
+    pub(crate) fn set_crashdump_entry_point(&mut self, entry_point: u64) {
+        self.rt_cfg.entry_point = Some(entry_point);
+    }
+
     pub(crate) fn interrupt_handle(&self) -> Arc<dyn InterruptHandle> {
         self.interrupt_handle.clone()
     }

src/hyperlight_host/src/mem/mgr.rs

@@ -143,6 +143,10 @@ pub(crate) struct SandboxMemoryManager<S: SharedMemory> {
     /// The next action to perform when this sandbox resumes:
     /// `Initialise` before the guest has run, `Call` afterwards.
     pub(crate) next_action: NextAction,
+    /// Guest virtual address of the guest binary's ELF entry point,
+    /// preserved across the `Initialise` -> `Call` transition so it
+    /// can fill `AT_ENTRY` in guest core dumps. 0 if unknown.
+    pub(crate) original_entrypoint: u64,
     /// Buffer for accumulating guest abort messages
     pub(crate) abort_buffer: Vec<u8>,
     /// Generation counter: how many snapshots have been taken from
@@ -283,6 +287,7 @@ where
             shared_mem,
             scratch_mem,
             next_action,
+            original_entrypoint: 0,
             abort_buffer: Vec::new(),
             snapshot_count: 0,
         }
@@ -315,6 +320,7 @@ where
             rsp_gva,
             sregs,
             next_action,
+            self.original_entrypoint,
             self.snapshot_count,
             host_functions,
         )
@@ -328,6 +334,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
         let scratch_mem = ExclusiveSharedMemory::new(s.layout().get_scratch_size())?;
         let next_action = s.next_action();
         let mut mgr = Self::new(layout, shared_mem, scratch_mem, next_action);
+        mgr.original_entrypoint = s.original_entrypoint();
         // Inherit the snapshot's generation number for the same
         // reason `restore_snapshot` does: the guest-visible counter
         // reflects "which snapshot is the sandbox currently a clone
@@ -359,6 +366,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
             scratch_mem: hscratch,
             layout: self.layout,
             next_action: self.next_action,
+            original_entrypoint: self.original_entrypoint,
             abort_buffer: self.abort_buffer,
             snapshot_count: self.snapshot_count,
         };
@@ -367,6 +375,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
             scratch_mem: gscratch,
             layout: self.layout,
             next_action: self.next_action,
+            original_entrypoint: self.original_entrypoint,
             abort_buffer: Vec::new(), // Guest doesn't need abort buffer
             snapshot_count: self.snapshot_count,
         };
@@ -504,6 +513,9 @@ impl SandboxMemoryManager<HostSharedMemory> {
         // sandbox currently a clone of", not "how many restores have
         // happened into this (possibly-reused) partition".
         self.snapshot_count = snapshot.snapshot_generation();
+        // Carry the guest ELF entry point across restore so crashdumps
+        // report the restored image's entry.
+        self.original_entrypoint = snapshot.original_entrypoint();
 
         self.update_scratch_bookkeeping()?;
         Ok((gsnapshot, gscratch))

src/hyperlight_host/src/sandbox/initialized_multi_use.rs

@@ -243,11 +243,11 @@ impl MultiUseSandbox {
         #[cfg(target_os = "linux")]
         crate::signal_handlers::setup_signal_handlers(&config)?;
 
-        // Build the runtime config from the caller's `SandboxConfiguration`
-        // so that `guest_core_dump` (crashdump) and `guest_debug_info` (gdb)
-        // take effect just like they do in the normal evolve path.
-        // `binary_path` and `entry_point` are not available from a snapshot
-        // and are left unset. This only affects metadata in core dumps.
+        // Runtime config for the restored sandbox. `guest_core_dump`
+        // (crashdump) and `guest_debug_info` (gdb) come from the caller's
+        // config. `binary_path` stays `None`. `set_up_hypervisor_partition`
+        // fills `entry_point` from the manager's entry point so crashdumps
+        // carry the correct `AT_ENTRY`.
         #[cfg(any(crashdump, gdb))]
         let rt_cfg = crate::sandbox::uninitialized::SandboxRuntimeConfig {
             #[cfg(crashdump)]
@@ -545,6 +545,11 @@ impl MultiUseSandbox {
 
         self.vm.set_stack_top(snapshot.stack_top_gva());
         self.vm.set_next_action(snapshot.next_action());
+        // Carry the guest ELF entry point across restore so a later
+        // crashdump fills `AT_ENTRY` from the restored image.
+        #[cfg(crashdump)]
+        self.vm
+            .set_crashdump_entry_point(snapshot.original_entrypoint());
 
         let current_regions: Vec<MemoryRegion> = self.vm.get_mapped_regions().cloned().collect();
         for region in &current_regions {

src/hyperlight_host/src/sandbox/snapshot/file/config.rs

@@ -177,6 +177,14 @@ pub(super) struct OciSnapshotConfig {
     pub(super) stack_top_gva: u64,
     /// Guest virtual address the loader resumes the paused call at.
     pub(super) entrypoint_addr: u64,
+    /// Guest virtual address of the ELF entry point
+    /// (`load_addr + e_entry - base_va`), preserved across the
+    /// Initialise->Call transition. Fills `AT_ENTRY` in core dumps so
+    /// gdb resolves PIE symbols. Optional: snapshots written before
+    /// this field existed deserialize to `0`, which core-dump code
+    /// treats as unknown.
+    #[serde(default)]
+    pub(super) original_entrypoint_addr: u64,
     /// Special registers captured from the paused vCPU, restored
     /// verbatim when resuming the call.
     pub(super) sregs: CommonSpecialRegisters,
@@ -480,6 +488,20 @@ impl OciSnapshotConfig {
             ));
         }
 
+        // ELF entry point GVA for `AT_ENTRY` in core dumps. 0 means
+        // unknown. Any other value must point inside the snapshot
+        // region, like `entrypoint_addr`.
+        if self.original_entrypoint_addr != 0
+            && (self.original_entrypoint_addr < snap_lo || self.original_entrypoint_addr >= snap_hi)
+        {
+            return Err(crate::new_error!(
+                "snapshot original entrypoint addr {:#x} is outside the snapshot region [{:#x}, {:#x})",
+                self.original_entrypoint_addr,
+                snap_lo,
+                snap_hi
+            ));
+        }
+
         // `stack_top_gva` is restored into the guest stack pointer.
         // Bound it to the architecture's addressable GVA range so a
         // malformed config cannot install an out-of-range stack
@@ -675,6 +697,7 @@ mod tests {
             cpu_vendor: CpuVendor::current(),
             stack_top_gva: 0x2000,
             entrypoint_addr: SandboxMemoryLayout::BASE_ADDRESS as u64,
+            original_entrypoint_addr: 0,
             sregs: distinct_sregs(),
             layout: MemoryLayout {
                 input_data_size: 0,
@@ -746,6 +769,7 @@ mod schema_pin {
   "cpu_vendor": "intel",
   "stack_top_gva": 3735928559,
   "entrypoint_addr": 8192,
+  "original_entrypoint_addr": 0,
   "sregs": {
     "cs": {
       "base": 1,
@@ -921,6 +945,7 @@ mod schema_pin {
   "cpu_vendor": "intel",
   "stack_top_gva": 3735928559,
   "entrypoint_addr": 8192,
+  "original_entrypoint_addr": 0,
   "sregs": {
     "tcr_el1": 1,
     "mair_el1": 2,

src/hyperlight_host/src/sandbox/snapshot/file/mod.rs

@@ -584,6 +584,7 @@ impl Snapshot {
             cpu_vendor: CpuVendor::current(),
             stack_top_gva: self.stack_top_gva,
             entrypoint_addr,
+            original_entrypoint_addr: self.original_entrypoint,
             sregs: *sregs,
             layout: MemoryLayout {
                 input_data_size: l.input_data_size(),
@@ -872,6 +873,7 @@ impl Snapshot {
             stack_top_gva: cfg.stack_top_gva,
             sregs: Some(cfg.sregs),
             next_action,
+            original_entrypoint: cfg.original_entrypoint_addr,
             snapshot_generation,
             host_functions,
         })

src/hyperlight_host/src/sandbox/snapshot/file_tests.rs

@@ -1765,6 +1765,28 @@ fn entrypoint_addr_below_base_address_rejected() {
     assert_err_contains(err, "entrypoint addr");
 }
 
+#[test]
+fn original_entrypoint_addr_outside_snapshot_region_rejected() {
+    let (_dir, path) = save_for_mutation();
+    rewrite_config(&path, |cfg| {
+        cfg["original_entrypoint_addr"] = Value::from(0xDEAD_BEEF_0000u64);
+    });
+    let err = unwrap_err_snapshot(Snapshot::checked_load(
+        &path,
+        OciTag::new("latest").unwrap(),
+    ));
+    assert_err_contains(err, "original entrypoint addr");
+}
+
+#[test]
+fn original_entrypoint_addr_zero_accepted() {
+    let (_dir, path) = save_for_mutation();
+    rewrite_config(&path, |cfg| {
+        cfg["original_entrypoint_addr"] = Value::from(0u64);
+    });
+    Snapshot::checked_load(&path, OciTag::new("latest").unwrap()).unwrap();
+}
+
 // `load`: skips blob digest verification, runs every
 // other validator.
 

src/hyperlight_host/src/sandbox/snapshot/mod.rs

@@ -95,6 +95,15 @@ pub struct Snapshot {
     /// The next action that should be performed on this snapshot
     next_action: NextAction,
 
+    /// Guest virtual address of the guest binary's ELF entry point
+    /// (`load_addr + e_entry - base_va`). Unlike `next_action`, which
+    /// transitions to `Call(dispatch_addr)` once the guest has run,
+    /// this preserves the original entry across that transition. Used
+    /// to fill `AT_ENTRY` in guest core dumps so a debugger can
+    /// compute the PIE load bias. 0 if unknown (e.g. an older
+    /// on-disk snapshot that predates this field).
+    original_entrypoint: u64,
+
     /// The generation number assigned to this snapshot when it was
     /// taken — i.e. "this is the Nth snapshot taken from the sandbox's
     /// execution path from init to here". Propagated into the
@@ -375,13 +384,16 @@ impl Snapshot {
             - hyperlight_common::layout::SCRATCH_TOP_EXN_STACK_OFFSET
             + 1;
 
+        let entrypoint_gva = load_addr + entrypoint_va - base_va;
+
         Ok(Self {
             memory: ReadonlySharedMemory::from_bytes(&memory, layout.snapshot_size())?,
             layout,
             load_info,
             stack_top_gva: exn_stack_top_gva,
             sregs: None,
-            next_action: NextAction::Initialise(load_addr + entrypoint_va - base_va),
+            next_action: NextAction::Initialise(entrypoint_gva),
+            original_entrypoint: entrypoint_gva,
             snapshot_generation: 0,
             host_functions: HostFunctionDetails {
                 host_functions: None,
@@ -408,6 +420,7 @@ impl Snapshot {
         stack_top_gva: u64,
         sregs: CommonSpecialRegisters,
         next_action: NextAction,
+        original_entrypoint: u64,
         snapshot_generation: u64,
         host_functions: HostFunctionDetails,
     ) -> Result<Self> {
@@ -561,6 +574,7 @@ impl Snapshot {
             stack_top_gva,
             sregs: Some(sregs),
             next_action,
+            original_entrypoint,
             snapshot_generation,
             host_functions,
         })
@@ -607,6 +621,13 @@ impl Snapshot {
         self.next_action
     }
 
+    /// Guest virtual address of the guest binary's ELF entry point,
+    /// preserved across the `Initialise` -> `Call` transition. Used
+    /// to fill `AT_ENTRY` in guest core dumps. 0 if unknown.
+    pub(crate) fn original_entrypoint(&self) -> u64 {
+        self.original_entrypoint
+    }
+
     /// Validate that `provided` is a superset of the host functions
     /// recorded in this snapshot: every function that was registered
     /// at snapshot time must also be present in `provided` with a
@@ -762,6 +783,7 @@ mod tests {
             0,
             default_sregs(),
             super::NextAction::None,
+            0,
             1,
             HostFunctionDetails::default(),
         )
@@ -779,6 +801,7 @@ mod tests {
             0,
             default_sregs(),
             super::NextAction::None,
+            0,
             2,
             HostFunctionDetails::default(),
         )

src/hyperlight_host/src/sandbox/uninitialized_evolve.rs

@@ -153,12 +153,14 @@ pub(crate) fn set_up_hypervisor_partition(
     // Store the original entry point address in the runtime config for core dumps.
     // This is needed because `next_action` transitions from `Initialise(addr)` to
     // `Call(dispatch_addr)` after guest initialisation, losing the original value
-    // that GDB needs to compute the PIE binary's load offset.
+    // that GDB needs to compute the PIE binary's load offset. The manager carries
+    // it across that transition (and across snapshot save/restore), so it is
+    // correct for both the evolve path and `MultiUseSandbox::from_snapshot`.
     #[cfg(crashdump)]
     let rt_cfg = {
         let mut rt_cfg = rt_cfg;
-        if let crate::sandbox::snapshot::NextAction::Initialise(addr) = mgr.next_action {
-            rt_cfg.entry_point = Some(addr);
+        if mgr.original_entrypoint != 0 {
+            rt_cfg.entry_point = Some(mgr.original_entrypoint);
         }
         rt_cfg
     };