Currently, the symbol ".rodata" may not be found in some vmlinux, and the strings command will still be used to get the linux banner string, but this gets two strings as below: # strings /usr/lib/debug/usr/lib/modules/6.5.0-0.rc2.17.fc39.x86_64/vmlinux |grep "Linux version" Linux version 6.5.0-0.rc2.17.fc39.x86_64 (mockbuild@23a79bad375e4c2c8c60f2d40df7df49) (gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4), GNU ld version 2.40-9.fc39) # SMP PREEMPT_DYNAMIC Linux version 6.5.0-0.rc2.17.fc39.x86_64 (mockbuild@23a79bad375e4c2c8c60f2d40df7df49) (gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4), GNU ld version 2.40-9.fc39) #1 SMP PREEMPT_DYNAMIC Mon Jul 17 14:57:35 UTC 2023 In the verify_namelist(), the while-loop will only determine if the above first string(linux banner) matches and break the loop. But actually the above second string is correct one. Eventually, crash startup with the following warning: # ./crash -s /usr/lib/debug/usr/lib/modules/6.5.0-0.rc2.17.fc39.x86_64/vmlinux /var/crash/127.0.0.1-2023-07-20-20\:50\:50/vmcore WARNING: kernel version inconsistency between vmlinux and dumpfile # ./crash -s WARNING: kernel version inconsistency between vmlinux and live memory Let's always try to match the correct one, otherwise still prints a warning as before. Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com&gt; --- kernel.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/kernel.c b/kernel.c index 546eed95eebd..9801812387bd 100644 --- a/kernel.c +++ b/kernel.c @@ -1375,8 +1375,6 @@ verify_namelist() buffer3[i++] = *p1++; buffer3[i] = NULLCHAR; } - - break; } pclose(pipe);

On 2023/07/24 10:17, HAGIO KAZUHITO(萩尾 一仁) wrote: > Hi Lianbo, > > Thank you for the fix. > > On 2023/07/21 13:36, Lianbo Jiang wrote: >> Currently, the symbol ".rodata" may not be found in some vmlinux, and >> the strings command will still be used to get the linux banner string, >> but this gets two strings as below: >> >> # strings /usr/lib/debug/usr/lib/modules/6.5.0-0.rc2.17.fc39.x86_64/vmlinux |grep "Linux version" >> Linux version 6.5.0-0.rc2.17.fc39.x86_64 (mockbuild@23a79bad375e4c2c8c60f2d40df7df49) (gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4), GNU ld version 2.40-9.fc39) # SMP PREEMPT_DYNAMIC >> Linux version 6.5.0-0.rc2.17.fc39.x86_64 (mockbuild@23a79bad375e4c2c8c60f2d40df7df49) (gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4), GNU ld version 2.40-9.fc39) #1 SMP PREEMPT_DYNAMIC Mon Jul 17 14:57:35 UTC 2023 >> >> In the verify_namelist(), the while-loop will only determine if the >> above first string(linux banner) matches and break the loop. But >> actually the above second string is correct one. Eventually, crash >> startup with the following warning: >> >> # ./crash -s /usr/lib/debug/usr/lib/modules/6.5.0-0.rc2.17.fc39.x86_64/vmlinux /var/crash/127.0.0.1-2023-07-20-20\:50\:50/vmcore >> WARNING: kernel version inconsistency between vmlinux and dumpfile >> >> # ./crash -s >> WARNING: kernel version inconsistency between vmlinux and live memory >> >> Let's always try to match the correct one, otherwise still prints a >> warning as before. >> >> Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com&gt; >> --- >> kernel.c | 2 -- >> 1 file changed, 2 deletions(-) >> >> diff --git a/kernel.c b/kernel.c >> index 546eed95eebd..9801812387bd 100644 >> --- a/kernel.c >> +++ b/kernel.c >> @@ -1375,8 +1375,6 @@ verify_namelist() >> buffer3[i++] = *p1++; >> buffer3[i] = NULLCHAR; >> } >> - >> - break; >> } >> pclose(pipe); >> > > I think you are fixing the fallback routine and that's good, but it's > better to fix get_linux_banner_from_vmlinux() first if possible. It's

much faster. Isn't it possible? >

> What do you see in "sections:" in "help -s"? And probably you can > determine the section where linux_banner is located, with the address of > linux_banner and KASLR offset. > > crash> help -s > ... > sections: > .text vma: ffffffff81000000 size: 14686984 > .rodata vma: ffffffff82000000 size: 5366231 > .pci_fixup vma: ffffffff8251e1e0 size: 14112 > ... > crash> sym linux_banner > ffffffffb5200a40 (D) linux_banner > crash> help -D | grep KERNELOFFSET > KERNELOFFSET=33200000 > > crash> eval ffffffffb5200a40 - 0x33200000 > hexadecimal: ffffffff82000a40 --> linux_banner is in ".rodata" If the vmlinux does not have only the ".rodata" symbol, is it possible to use "__start_rodata" symbol or something? i.e. is there no symbol that has the same address as .rodata section?

ffffffffb5200000 (d) .rodata ffffffffb5200000 (D) __start_rodata Thanks, Kazu

On 2023/07/24 15:51, lijiang wrote: > How about reading out the linux_banner string to a buffer with readmem()? No, this is a version check for the namelist (vmlinux).

> If the vmlinux does not have only the ".rodata" symbol, is it possible >> to use "__start_rodata" symbol or something? i.e. is there no symbol >> that has the same address as .rodata section? >> >> > I tried the "__start_rodata" symbol, but it does not work. How did you try? There is no "__start_rodata" symbol? I mean something like this: --- a/kernel.c +++ b/kernel.c @@ -11893,8 +11893,13 @@ int get_linux_banner_from_vmlinux(char *buf, size_t size) { struct bfd_section *sect; long offset; + ulong start_rodata; - if (!kernel_symbol_exists(".rodata")) + if (kernel_symbol_exists(".rodata")) + start_rodata = symbol_value(".rodata"); + else if (kernel_symbol_exists("__start_rodata")) + start_rodata = symbol_value("__start_rodata"); + else return FALSE; sect = bfd_get_section_by_name(st->bfd, ".rodata");

On 2023/07/24 16:33, lijiang wrote: > On Mon, Jul 24, 2023 at 3:07 PM HAGIO KAZUHITO(萩尾 一仁) < k-hagio-ab(a)nec.com&gt; > wrote: > >> On 2023/07/24 15:51, lijiang wrote: >>> How about reading out the linux_banner string to a buffer with readmem()? >> >> No, this is a version check for the namelist (vmlinux). >> >> > Ah, you are right, Kazu. > >>> If the vmlinux does not have only the ".rodata" symbol, is it possible >>>> to use "__start_rodata" symbol or something? i.e. is there no symbol >>>> that has the same address as .rodata section? >>>> >>>> >>> I tried the "__start_rodata" symbol, but it does not work. >> >> How did you try? There is no "__start_rodata" symbol? >> >> I mean something like this: >> >> --- a/kernel.c >> +++ b/kernel.c >> @@ -11893,8 +11893,13 @@ int get_linux_banner_from_vmlinux(char *buf, >> size_t size) >> { >> struct bfd_section *sect; >> long offset; >> + ulong start_rodata; >> >> - if (!kernel_symbol_exists(".rodata")) >> + if (kernel_symbol_exists(".rodata")) >> + start_rodata = symbol_value(".rodata"); >> + else if (kernel_symbol_exists("__start_rodata")) >> + start_rodata = symbol_value("__start_rodata"); >> + else >> return FALSE; >> >> sect = bfd_get_section_by_name(st->bfd, ".rodata"); >> > > The ".rodata" is a section, I mistakenly replaced the ".rodata" with the > symbol "__start_rodata" in a debug patch, so it does not work. :-) > > diff --git a/kernel.c b/kernel.c > index 546eed9..3c50fa4 100644 > --- a/kernel.c > +++ b/kernel.c > @@ -11894,7 +11894,7 @@ int get_linux_banner_from_vmlinux(char *buf, size_t > size) > struct bfd_section *sect; > long offset; > > - if (!kernel_symbol_exists(".rodata")) > + if (!kernel_symbol_exists("__start_rodata")) > return FALSE; > > sect = bfd_get_section_by_name(st->bfd, ".rodata"); > @@ -11907,7 +11907,7 @@ int get_linux_banner_from_vmlinux(char *buf, size_t > size) > * value in vmlinux file, but relative offset to linux_banner > * object in .rodata section is idential. > */ > - offset = symbol_value("linux_banner") - symbol_value(".rodata"); > + offset = symbol_value("linux_banner") - > symbol_value("__start_rodata"); > > if (!bfd_get_section_contents(st->bfd, > sect, > @@ -11916,5 +11916,6 @@ int get_linux_banner_from_vmlinux(char *buf, size_t > size) > size)) > return FALSE; > > + error(INFO, "%s\n", buf); > return TRUE; > > For now, the get_linux_banner_from_vmlinux() works again with the debug > patch. Good, thanks for the test. I will send a patch for this.

On 2023/07/21 13:36, Lianbo Jiang wrote: > Currently, the symbol ".rodata" may not be found in some vmlinux, and > the strings command will still be used to get the linux banner string, > but this gets two strings as below: > > # strings /usr/lib/debug/usr/lib/modules/6.5.0-0.rc2.17.fc39.x86_64/vmlinux |grep "Linux version" > Linux version 6.5.0-0.rc2.17.fc39.x86_64 (mockbuild@23a79bad375e4c2c8c60f2d40df7df49) (gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4), GNU ld version 2.40-9.fc39) # SMP PREEMPT_DYNAMIC > Linux version 6.5.0-0.rc2.17.fc39.x86_64 (mockbuild@23a79bad375e4c2c8c60f2d40df7df49) (gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4), GNU ld version 2.40-9.fc39) #1 SMP PREEMPT_DYNAMIC Mon Jul 17 14:57:35 UTC 2023 > > In the verify_namelist(), the while-loop will only determine if the > above first string(linux banner) matches and break the loop. But > actually the above second string is correct one. Eventually, crash > startup with the following warning: > > # ./crash -s /usr/lib/debug/usr/lib/modules/6.5.0-0.rc2.17.fc39.x86_64/vmlinux /var/crash/127.0.0.1-2023-07-20-20\:50\:50/vmcore > WARNING: kernel version inconsistency between vmlinux and dumpfile > > # ./crash -s > WARNING: kernel version inconsistency between vmlinux and live memory > > Let's always try to match the correct one, otherwise still prints a > warning as before. > > Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com&gt; > --- > kernel.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/kernel.c b/kernel.c > index 546eed95eebd..9801812387bd 100644 > --- a/kernel.c > +++ b/kernel.c > @@ -1375,8 +1375,6 @@ verify_namelist() > buffer3[i++] = *p1++; > buffer3[i] = NULLCHAR; > } > - > - break; > } > pclose(pipe); > This fix itself looks good. Acked-by: Kazuhito Hagio <k-hagio-ab(a)nec.com&gt; will merge this later.