Persist guest ELF entry point for crashdump AT_ENTRY

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>

Author: ludfjig

src/hyperlight_host/src/mem/mgr.rs

@@ -143,6 +143,10 @@ pub(crate) struct SandboxMemoryManager<S: SharedMemory> {
     /// The next action to perform when this sandbox resumes:
     /// `Initialise` before the guest has run, `Call` afterwards.
     pub(crate) next_action: NextAction,
+    /// Guest virtual address of the guest binary's ELF entry point,
+    /// preserved across the `Initialise` -> `Call` transition so it
+    /// can fill `AT_ENTRY` in guest core dumps. 0 if unknown.
+    pub(crate) original_entrypoint: u64,
     /// Buffer for accumulating guest abort messages
     pub(crate) abort_buffer: Vec<u8>,
     /// Generation counter: how many snapshots have been taken from
@@ -283,6 +287,7 @@ where
             shared_mem,
             scratch_mem,
             next_action,
+            original_entrypoint: 0,
             abort_buffer: Vec::new(),
             snapshot_count: 0,
         }
@@ -315,6 +320,7 @@ where
             rsp_gva,
             sregs,
             next_action,
+            self.original_entrypoint,
             self.snapshot_count,
             host_functions,
         )
@@ -328,6 +334,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
         let scratch_mem = ExclusiveSharedMemory::new(s.layout().get_scratch_size())?;
         let next_action = s.next_action();
         let mut mgr = Self::new(layout, shared_mem, scratch_mem, next_action);
+        mgr.original_entrypoint = s.original_entrypoint();
         // Inherit the snapshot's generation number for the same
         // reason `restore_snapshot` does: the guest-visible counter
         // reflects "which snapshot is the sandbox currently a clone
@@ -359,6 +366,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
             scratch_mem: hscratch,
             layout: self.layout,
             next_action: self.next_action,
+            original_entrypoint: self.original_entrypoint,
             abort_buffer: self.abort_buffer,
             snapshot_count: self.snapshot_count,
         };
@@ -367,6 +375,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
             scratch_mem: gscratch,
             layout: self.layout,
             next_action: self.next_action,
+            original_entrypoint: self.original_entrypoint,
             abort_buffer: Vec::new(), // Guest doesn't need abort buffer
             snapshot_count: self.snapshot_count,
         };

src/hyperlight_host/src/sandbox/snapshot/file/config.rs

@@ -177,6 +177,14 @@ pub(super) struct OciSnapshotConfig {
     pub(super) stack_top_gva: u64,
     /// Guest virtual address the loader resumes the paused call at.
     pub(super) entrypoint_addr: u64,
+    /// Guest virtual address of the ELF entry point
+    /// (`load_addr + e_entry - base_va`), preserved across the
+    /// Initialise->Call transition. Fills `AT_ENTRY` in core dumps so
+    /// gdb resolves PIE symbols. Optional: snapshots written before
+    /// this field existed deserialize to `0`, which core-dump code
+    /// treats as unknown.
+    #[serde(default)]
+    pub(super) original_entrypoint_addr: u64,
     /// Special registers captured from the paused vCPU, restored
     /// verbatim when resuming the call.
     pub(super) sregs: CommonSpecialRegisters,
@@ -675,6 +683,7 @@ mod tests {
             cpu_vendor: CpuVendor::current(),
             stack_top_gva: 0x2000,
             entrypoint_addr: SandboxMemoryLayout::BASE_ADDRESS as u64,
+            original_entrypoint_addr: 0,
             sregs: distinct_sregs(),
             layout: MemoryLayout {
                 input_data_size: 0,
@@ -746,6 +755,7 @@ mod schema_pin {
   "cpu_vendor": "intel",
   "stack_top_gva": 3735928559,
   "entrypoint_addr": 8192,
+  "original_entrypoint_addr": 0,
   "sregs": {
     "cs": {
       "base": 1,
@@ -921,6 +931,7 @@ mod schema_pin {
   "cpu_vendor": "intel",
   "stack_top_gva": 3735928559,
   "entrypoint_addr": 8192,
+  "original_entrypoint_addr": 0,
   "sregs": {
     "tcr_el1": 1,
     "mair_el1": 2,

src/hyperlight_host/src/sandbox/snapshot/file/mod.rs

@@ -584,6 +584,7 @@ impl Snapshot {
             cpu_vendor: CpuVendor::current(),
             stack_top_gva: self.stack_top_gva,
             entrypoint_addr,
+            original_entrypoint_addr: self.original_entrypoint,
             sregs: *sregs,
             layout: MemoryLayout {
                 input_data_size: l.input_data_size(),
@@ -872,6 +873,7 @@ impl Snapshot {
             stack_top_gva: cfg.stack_top_gva,
             sregs: Some(cfg.sregs),
             next_action,
+            original_entrypoint: cfg.original_entrypoint_addr,
             snapshot_generation,
             host_functions,
         })

src/hyperlight_host/src/sandbox/snapshot/mod.rs

@@ -95,6 +95,15 @@ pub struct Snapshot {
     /// The next action that should be performed on this snapshot
     next_action: NextAction,
 
+    /// Guest virtual address of the guest binary's ELF entry point
+    /// (`load_addr + e_entry - base_va`). Unlike `next_action`, which
+    /// transitions to `Call(dispatch_addr)` once the guest has run,
+    /// this preserves the original entry across that transition. Used
+    /// to fill `AT_ENTRY` in guest core dumps so a debugger can
+    /// compute the PIE load bias. 0 if unknown (e.g. an older
+    /// on-disk snapshot that predates this field).
+    original_entrypoint: u64,
+
     /// The generation number assigned to this snapshot when it was
     /// taken — i.e. "this is the Nth snapshot taken from the sandbox's
     /// execution path from init to here". Propagated into the
@@ -375,13 +384,16 @@ impl Snapshot {
             - hyperlight_common::layout::SCRATCH_TOP_EXN_STACK_OFFSET
             + 1;
 
+        let entrypoint_gva = load_addr + entrypoint_va - base_va;
+
         Ok(Self {
             memory: ReadonlySharedMemory::from_bytes(&memory, layout.snapshot_size())?,
             layout,
             load_info,
             stack_top_gva: exn_stack_top_gva,
             sregs: None,
-            next_action: NextAction::Initialise(load_addr + entrypoint_va - base_va),
+            next_action: NextAction::Initialise(entrypoint_gva),
+            original_entrypoint: entrypoint_gva,
             snapshot_generation: 0,
             host_functions: HostFunctionDetails {
                 host_functions: None,
@@ -408,6 +420,7 @@ impl Snapshot {
         stack_top_gva: u64,
         sregs: CommonSpecialRegisters,
         next_action: NextAction,
+        original_entrypoint: u64,
         snapshot_generation: u64,
         host_functions: HostFunctionDetails,
     ) -> Result<Self> {
@@ -561,6 +574,7 @@ impl Snapshot {
             stack_top_gva,
             sregs: Some(sregs),
             next_action,
+            original_entrypoint,
             snapshot_generation,
             host_functions,
         })
@@ -607,6 +621,13 @@ impl Snapshot {
         self.next_action
     }
 
+    /// Guest virtual address of the guest binary's ELF entry point,
+    /// preserved across the `Initialise` -> `Call` transition. Used
+    /// to fill `AT_ENTRY` in guest core dumps. 0 if unknown.
+    pub(crate) fn original_entrypoint(&self) -> u64 {
+        self.original_entrypoint
+    }
+
     /// Validate that `provided` is a superset of the host functions
     /// recorded in this snapshot: every function that was registered
     /// at snapshot time must also be present in `provided` with a
@@ -762,6 +783,7 @@ mod tests {
             0,
             default_sregs(),
             super::NextAction::None,
+            0,
             1,
             HostFunctionDetails::default(),
         )
@@ -779,6 +801,7 @@ mod tests {
             0,
             default_sregs(),
             super::NextAction::None,
+            0,
             2,
             HostFunctionDetails::default(),
         )

src/hyperlight_host/src/sandbox/uninitialized_evolve.rs

@@ -153,12 +153,14 @@ pub(crate) fn set_up_hypervisor_partition(
     // Store the original entry point address in the runtime config for core dumps.
     // This is needed because `next_action` transitions from `Initialise(addr)` to
     // `Call(dispatch_addr)` after guest initialisation, losing the original value
-    // that GDB needs to compute the PIE binary's load offset.
+    // that GDB needs to compute the PIE binary's load offset. The manager carries
+    // it across that transition (and across snapshot save/restore), so it is
+    // correct for both the evolve path and `MultiUseSandbox::from_snapshot`.
     #[cfg(crashdump)]
     let rt_cfg = {
         let mut rt_cfg = rt_cfg;
-        if let crate::sandbox::snapshot::NextAction::Initialise(addr) = mgr.next_action {
-            rt_cfg.entry_point = Some(addr);
+        if mgr.original_entrypoint != 0 {
+            rt_cfg.entry_point = Some(mgr.original_entrypoint);
         }
         rt_cfg
     };