mjhjmtu

I'm trying to debug a prototype CPU that throws unhandled signal 11s and signal 7s in the startup process.

Here is what the kernel prints out. I have added extra print statements to the kernel to debug exactly which userspace processes are exhibiting the error.

[ 0.880000] Execing: /usr/bin/readlink
[ 0.884000] readlink[85]: unhandled signal 7 code 0x1 at 0x00000020000b8f60 in libc-2.26.so[2000049000+13e000]
[ 0.884000] CPU: 0 PID: 85 Comm: readlink Not tainted 4.15.0-rc6-31580-g9c3074b5c2cd-dirty #20
[ 0.884000] sepc: 00000020000b8f60 ra : 00000020000b8d2c sp : 0000003ffffd9a60
[ 0.884000] gp : 00000000001028a8 tp : 0000002000192710 t0 : 0000000000000458
[ 0.884000] t1 : 00000020000aae98 t2 : ffffffffffffffff s0 : 000000200018d468
[ 0.884000] s1 : 000000200018e7d0 a0 : 000000200018e810 a1 : 000000200018c768
[ 0.884000] a2 : fffffffffbad2884 a3 : 0000000000008000 a4 : 000000200018ef38
[ 0.884000] a5 : 0000000000000001 a6 : 0000000000000000 a7 : 0000000000000040
[ 0.884000] s2 : 0000000000000001 s3 : 0000002000192010 s4 : 000000200018c4b0
[ 0.884000] s5 : 0000000000000001 s6 : 000000200018dd58 s7 : 0000000000000000
[ 0.884000] s8 : 00000000000e3388 s9 : 0000000000000040 s10: 000000000009c000
[ 0.884000] s11: 0000000000000048 t3 : 0000000000061e98 t4 : 0000000000000002
[ 0.884000] t5 : 000000200004bb64 t6 : 0000000000000000
[ 0.884000] sstatus: 8000000200006020 sbadaddr: 0000000006200893 scause: 0000000000000006
[ 0.888000] Execing: /bin/rm

Here I see an unhandled signal 7 in readlink, which is executing some libc function. My question is, how do I determine which instruction in libc is causing this? The machine status printout does not include the instruction, only the sepc. Since libc is dynamically linked, I'm not sure how to find its reference in libc's code.

If I'm reading the kernel's source correctly, this line:

readlink[85]: unhandled signal 7 code 0x1 at 0x00000020000b8f60 in libc-2.26.so[2000049000+13e000]

Tells you what you need to know. libc is loaded at hexadecimal 0x2000049000, and is 0x13e000 bytes long. The address that the signal happened at is 0x00000020000b8f60. In order to figure out where relative to libc the error happens, compute 0x00000020000b8f60 - 0x2000049000.

I get 0x6ff60, so look for that location in objdump -d libc... or nm -g libc....