From 3e2261d83176752f3ea21e0c97f330b4c1757437 Mon Sep 17 00:00:00 2001 From: salmonik Date: Tue, 4 Aug 2026 01:44:05 +0200 Subject: v0.5.9: fix OptiPlex heap crash — EBS retry must not rebuild the free list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root cause: on real hardware SetMode can invalidate the pre-captured ExitBootServices map key, so EBS fails and the retry refreshed the map via capture_memory_map -> init_heap, which REBUILT the free list from the raw map and wiped the allocation state of every pre-EBS live object (the display shadow and the vt grids). Their spans became free while still live, later allocations carved inside the shadow, and the display writes clobbered them — zeroed back-pointers (family A ptr=0x404443e0 block=0x0) and gray glyph pixels (family B 0xaaaaaa00aaaaaa = 0x00AAAAAA = PALETTE[7] fg-7 text colour, not a firmware scrub). Fix: refresh_and_exit now re-captures the map and returns a fresh EBS key without rebuilding the free list (refresh_map_key); the free list is the authoritative live-allocation state. Verified in QEMU under a forced EBS failure (SIMULATE_EBS_FAILURE test hook): verify ok, probe NOT free, flhead outside the shadow — identical to a clean boot, and the full shell sequence is crash-free. Also: removed the crash-family debug markers from the screen (boot-time heapdbg lines, vt verify marker, shadow marker) — the vt grid self-check stays serial-only. Version 0.5.8 -> 0.5.9. --- rsnix/src/memory.rs | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 105 insertions(+), 2 deletions(-) (limited to 'rsnix/src/memory.rs') diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs index 3ba53fc..099f607 100644 --- a/rsnix/src/memory.rs +++ b/rsnix/src/memory.rs @@ -624,6 +624,20 @@ fn heap_guard_report(ptr: usize, rsp: usize, size: usize, align: usize) -> ! { /// .bss working buffer so no pool allocation (and thus no memory-map change) /// occurs between GetMemoryMap and ExitBootServices. pub fn capture_memory_map(bs: &BootServices) -> Result { + capture_memory_map_impl(bs, true) +} + +/// Re-capture the memory map and return a FRESH ExitBootServices key +/// WITHOUT rebuilding the heap free list. Used by the EBS retry path: +/// a rebuild from the raw map wipes the allocation state of every +/// pre-EBS live allocation (the display shadow, the vt grids) — their +/// spans then become free while still in use, and later allocations +/// land inside the live shadow (the OptiPlex crash family). +pub fn refresh_map_key(bs: &BootServices) -> Result { + capture_memory_map_impl(bs, false) +} + +fn capture_memory_map_impl(bs: &BootServices, rebuild: bool) -> Result { let mut map_key: usize = 0; let mut desc_size: usize = 0; let mut desc_ver: u32 = 0; @@ -694,7 +708,9 @@ pub fn capture_memory_map(bs: &BootServices) -> Result { // Do NOT free anything — the static buffer stays. Map key is still // valid because no pool allocation/free happened after GetMemoryMap. - init_heap(); + if rebuild { + init_heap(); + } Ok(map_key) } @@ -705,7 +721,13 @@ pub fn capture_memory_map(bs: &BootServices) -> Result { /// `image_handle` must be the valid EFI image handle this kernel was /// started with (opaque firmware pointer; never dereferenced here). pub unsafe fn refresh_and_exit(bs: &BootServices, image_handle: Handle) -> Result { - let key = capture_memory_map(bs)?; + // Fresh key WITHOUT rebuilding the heap free list: a rebuild from the + // raw map wipes the allocation state of every pre-EBS live allocation + // (the display shadow, the vt grids) — their spans then become free + // while still in use, and later allocations land inside the live + // shadow (the OptiPlex crash family: display writes clobber heap + // objects, zeroed back-pointers, gray-text pixels). + let key = refresh_map_key(bs)?; let status = unsafe { (bs.exit_boot_services)(image_handle, key) }; if status == EFI_SUCCESS { Ok(key) @@ -833,6 +855,87 @@ pub fn heap_stats() -> HeapStats { } } +/// DEBUG (crash-family): which free block contains `addr`, if any. +/// Returns `(block_base, block_size, offset_within_block)`. +/// +/// The OptiPlex heap-corruption dumps land at deterministic offsets +/// inside the shadow's would-be span; this tells us whether the shadow +/// block (or any block spanning that offset) has leaked back into the +/// free list at shell entry or later. +pub fn freelist_contains(addr: usize) -> Option<(usize, usize, usize)> { + unsafe { + let mut cur = FREE_LIST; + while !cur.is_null() { + let base = cur as usize; + let size = (*cur).size; + if addr >= base && addr < base.saturating_add(size) { + return Some((base, size, addr - base)); + } + cur = (*(*cur).links()).next; + } + None + } +} + +/// DEBUG (crash-family): the free list head block (base, size). +pub fn freelist_head() -> Option<(usize, usize)> { + unsafe { + if FREE_LIST.is_null() { + None + } else { + Some((FREE_LIST as usize, (*FREE_LIST).size)) + } + } +} + +/// DEBUG (OptiPlex sim): force the first ExitBootServices call to fail, +/// exercising the capture_memory_map -> init_heap free-list rebuild that +/// wiped the pre-EBS shadow on real hardware. Returns true when the +/// simulation is armed (one shot). +pub static mut SIMULATE_EBS_FAILURE: bool = false; +pub fn simulate_ebs_failure() -> bool { + unsafe { + let r = SIMULATE_EBS_FAILURE; + SIMULATE_EBS_FAILURE = false; + r + } +} + +/// DEBUG (crash-family): walk the free list, formatting at most `max` +/// blocks as text lines for the screen/serial. +/// +/// Snapshot the walk into a fixed stack array first: printing the lines +/// itself allocates, and an interleaved alloc/free would shift the list +/// under the walk (the shell's tty path allocates per line). +pub fn freelist_lines(max: usize) -> alloc::vec::Vec { + let mut out = alloc::vec::Vec::new(); + unsafe { + let mut cur = FREE_LIST; + let cap = max.min(24); + let mut snap: [(usize, usize); 24] = [(0, 0); 24]; + let mut seen = 0usize; + while !cur.is_null() && seen < cap { + snap[seen] = (cur as usize, (*cur).size); + seen += 1; + cur = (*(*cur).links()).next; + } + if seen == 0 { + out.push("fl[] EMPTY".into()); + } else { + for (base, size) in snap[..seen].iter() { + out.push(alloc::format!( + "fl[{}] {:#x} size={:#x} end={:#x}", + out.len(), + base, + size, + base.wrapping_add(*size) + )); + } + } + } + out +} + /// Allocator smoke test — exercises alloc/free/coalesce without touching /// the heap itself (fixed-size stack arrays only). Returns true on success. pub fn self_test() -> bool { -- cgit v1.2.3