[Crash-utility] [PATCH] Expand search for banner string to get phys_base

Hi Dave, When tring to debug a kernel core file generated from Debian 9.2 + 4.9 kernel with base address randomized (this core is create for a qemu vm), it gives the error as: WARNING: cannot determine physical base address: defaulting to 0 GNU gdb (GDB) 7.6 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-unknown-linux-gnu"... WARNING: failed to init kexec backup region WARNING: cannot read linux_banner string Taking a look at the code around x86_64_virt_phys_base(), it determines phys_base by searching around machdep->machspec->phys_base(in my case it's 0) +/-16MB for banner string at banner string offset (get from symbol). However, with base address randomized, the real physical address could be far from 0 (or virtual address 0xffffffff80000000). Therefore, -16MB/+16MB is not enough especially for machine with large ram . I increased it to 0xFFFFF00000 for my 256g core file and it works. - for (phys = (ulong)(-MEGABYTES(16)); phys != MEGABYTES(16+1); + for (phys = (ulong)(-MEGABYTES(32)); phys != 0xFFFFF00000; phys += MEGABYTES(1)) { if (readmem(linux_banner_phys + phys, PHYSADDR, buf, strlen("Linux version"), "linux_banner search", QUIET|RETURN_ON_ERROR) && STRNEQ(buf, "Linux version")) { if (CRASHDEBUG(1)) fprintf(fp, "virtual dump phys_base: %lx %s\n", phys, machdep->machspec->phys_base != phys ? "override" : ""); machdep->machspec->phys_base = phys; return TRUE; } } Please feel free to let me know if you need sample dumps to verify. Thx. Regards, Ran