----- Original Message ----- > I'm trying to add crash support for kdumps from kASLR'd kernels. I've > got it working with a few small changes and I wanted to solicit > comments before sending a patch. Excellent! > 1) The --reloc flag appears to specify an offset to be subtracted from > the loaded address, when the aslr offset is added. It's annoying to > try to specify negative numbers on the command line, so I'd like to > add another argument --aslr which is the same as --reloc but negates > the value. Not a problem. In fact, since they really are different concepts, I'd prefer it. But can you make it --kalsr? A couple questions -- how would the user know what the offset is?

And I had thought that the upstream discussion was geared towards making it work automatically -- at least with kdump dumpfiles -- such that the kASLR offset would be made a VMCOREINFO item?

> 2) There are some symbols which should not be relocated. Specifically > the per_cpu section symbols are zero based offsets which should not > have the offset apply. Additionally there are VDSO symbols which are > fixed even with kASLR enabled. To fix this I'd like to add code to > iterate through the section and find the end of the last section and > only apply the relocation value to values after the start of text but > before the end of the last section. Right... > thanks, > Andy Good to hear from you -- I figured that when I saw your subscription request, with it being the first/only "google.com" address ever, that something interesting was forthcoming... Thanks, Dave Anderson -- Crash-utility mailing list Crash-utility(a)redhat.com https://www.redhat.com/mailman/listinfo/crash-utility

----- Original Message ----- > On Tue, Oct 15, 2013 at 11:36 AM, Dave Anderson <anderson(a)redhat.com&gt; wrote: > > > > > > ----- Original Message ----- > >> I'm trying to add crash support for kdumps from kASLR'd kernels. I've > >> got it working with a few small changes and I wanted to solicit > >> comments before sending a patch. > > > > Excellent! > > > >> 1) The --reloc flag appears to specify an offset to be subtracted from > >> the loaded address, when the aslr offset is added. It's annoying to > >> try to specify negative numbers on the command line, so I'd like to > >> add another argument --aslr which is the same as --reloc but negates > >> the value. > > > > Not a problem. In fact, since they really are different concepts, I'd > > prefer it. But can you make it --kalsr? > > > > A couple questions -- how would the user know what the offset is? > > > > The offset is output in the dmesg buffer. I don't really know how > crashes are analyzed elsewhere, but this fits in well with our > debugging workflow. Is this a problem for the usual workflow? OK, so for dumpfiles, it would be displayed somewhere in the panic message stream at the end of the kernel log buffer. But to access that information, the kalsr offset would be required to read the buffer contents from the dumpfile. Given just a vmlinux and vmcore, how would a user know what the offset would be? If it's in the VMCOREINFO notes section, then it can be read by simply parsing the ELF header contents in an uncompressed ELF vmcore (/proc/vmcore copy), or parsing the VMCOREINFO data that makedumpfile copies from /proc/vmcore to the compressed kdump's header. Also -- for running crash on the live system, does /proc/kallsyms reflect the relocated symbol values? Dave -- Crash-utility mailing list Crash-utility(a)redhat.com https://www.redhat.com/mailman/listinfo/crash-utility

----- Original Message ----- > I agree that's the correct solution, I was thinking of having a first > patch to make something workable with the command line arg and > identify any issues. Then writing another patch once the next kASLR > version goes out with offset data included in the VMCOREINFO. I > could also try something like the force_relocate function for x86 for > auto-determining the offset. The x86 version only supports > force_relocate for live debugging, but it doesn't look like it would > be a difficult change. Would you like to see that in a patch? Are you talking about working with a vmlinux/vmcore pair with no other information? Or are you referring to live system analysis automatically working? Dave -- Crash-utility mailing list Crash-utility(a)redhat.com https://www.redhat.com/mailman/listinfo/crash-utility

On Wed, Oct 16, 2013 at 9:02 AM, Andrew Honig <ahonig(a)google.com&gt; wrote: > I'm talking about working with a vmlinux/vmcore pair. To get crash > working with the current version of kASLR that doesn't have the offset > data specifically in the VMCOREINFO I could use another symbol in the > VMCOREINFO to calculate the offset. For example _stext is already in > the VMCOREINFO. I could get the offset of _stext from the VMCOREINFO, > then get the offset of _stext from the vmlinux and subtract them to > get the ASLR offset. Doing this math seems like a good approach. Are there any downsides to inferring the kASLR offset this way?