On 2023/07/24 15:51, lijiang wrote:
>> I think you are fixing the fallback routine and that's
good, but it's
>> better to fix get_linux_banner_from_vmlinux() first if possible. It's
>
Thank you for the comments, Kazu.
They are different issues. The fallback routine(strings) also needs to be
fixed, and the get_linux_banner_from_vmlinux() failure is another issue.
Yes, will merge this later.
> much faster. Isn't it possible?
>>
As I mentioned in patch log, the symbol ".rodata" was not found in some
vmlinux, and so far I haven't got any equivalent symbols to achieve the
purpose.
crash> sym .rodata
symbol not found: .rodata
possible alternatives:
(none found)
crash>
But the following change works well for this case:
diff --git a/kernel.c b/kernel.c
index 546eed9..a4ce5bf 100644
--- a/kernel.c
+++ b/kernel.c
@@ -11891,6 +11891,7 @@ check_vmcoreinfo(void)
static
int get_linux_banner_from_vmlinux(char *buf, size_t size)
{
+#if 0
struct bfd_section *sect;
long offset;
@@ -11917,4 +11918,10 @@ int get_linux_banner_from_vmlinux(char *buf,
size_t size)
return FALSE;
return TRUE;
+#else
+ if (!readmem(symbol_value("linux_banner"), KVADDR, buf, size,
"linux_banner", RETURN_ON_ERROR))
+ return FALSE;
+
+ return TRUE;
+#endif
}
How about reading out the linux_banner string to a buffer with readmem()?
No, this is a version check for the namelist (vmlinux).
>> What do you see in "sections:" in "help -s"? And probably
you can
>> determine the section where linux_banner is located, with the address of
>> linux_banner and KASLR offset.
>>
>> crash> help -s
>> ...
>> sections:
>> .text vma: ffffffff81000000 size: 14686984
>> .rodata vma: ffffffff82000000 size: 5366231
>> .pci_fixup vma: ffffffff8251e1e0 size: 14112
>> ...
>> crash> sym linux_banner
>> ffffffffb5200a40 (D) linux_banner
>> crash> help -D | grep KERNELOFFSET
>> KERNELOFFSET=33200000
>>
>> crash> eval ffffffffb5200a40 - 0x33200000
>> hexadecimal: ffffffff82000a40 --> linux_banner is in ".rodata"
>
> If the vmlinux does not have only the ".rodata" symbol, is it possible
> to use "__start_rodata" symbol or something? i.e. is there no symbol
> that has the same address as .rodata section?
>
>
I tried the "__start_rodata" symbol, but it does not work.
How did you try? There is no "__start_rodata" symbol?
I mean something like this:
--- a/kernel.c
+++ b/kernel.c
@@ -11893,8 +11893,13 @@ int get_linux_banner_from_vmlinux(char *buf,
size_t size)
{
struct bfd_section *sect;
long offset;
+ ulong start_rodata;
- if (!kernel_symbol_exists(".rodata"))
+ if (kernel_symbol_exists(".rodata"))
+ start_rodata = symbol_value(".rodata");
+ else if (kernel_symbol_exists("__start_rodata"))
+ start_rodata = symbol_value("__start_rodata");
+ else
return FALSE;
sect = bfd_get_section_by_name(st->bfd, ".rodata");
@@ -11907,7 +11912,7 @@ int get_linux_banner_from_vmlinux(char *buf,
size_t size)
* value in vmlinux file, but relative offset to linux_banner
* object in .rodata section is idential.
*/
- offset = symbol_value("linux_banner") -
symbol_value(".rodata");
+ offset = symbol_value("linux_banner") - start_rodata;
if (!bfd_get_section_contents(st->bfd,
sect,
Thanks,
Kazu