Those functions are going to be used for netdumps too. --- Makefile | 7 +- defs.h | 7 + kaslr_helper.c | 461 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ sadump.c | 486 +++++---------------------------------------------------- symbols.c | 6 +- 5 files changed, 513 insertions(+), 454 deletions(-) create mode 100644 kaslr_helper.c diff --git a/Makefile b/Makefile index bdc8321..f8647b3 100644 --- a/Makefile +++ b/Makefile @@ -71,7 +71,7 @@ CFILES=main.c tools.c global_data.c memory.c filesys.c help.c task.c \ xen_hyper.c xen_hyper_command.c xen_hyper_global_data.c \ xen_hyper_dump_tables.c kvmdump.c qemu.c qemu-load.c sadump.c ipcs.c \ ramdump.c vmware_vmss.c \ - xen_dom0.c + xen_dom0.c kaslr_helper.c SOURCE_FILES=${CFILES} ${GENERIC_HFILES} ${MCORE_HFILES} \ ${REDHAT_CFILES} ${REDHAT_HFILES} ${UNWIND_HFILES} \ @@ -90,7 +90,7 @@ OBJECT_FILES=main.o tools.o global_data.o memory.o filesys.o help.o task.o \ xen_hyper.o xen_hyper_command.o xen_hyper_global_data.o \ xen_hyper_dump_tables.o kvmdump.o qemu.o qemu-load.o sadump.o ipcs.o \ ramdump.o vmware_vmss.o \ - xen_dom0.o + xen_dom0.o kaslr_helper.o MEMORY_DRIVER_FILES=memory_driver/Makefile memory_driver/crash.c memory_driver/README @@ -517,6 +517,9 @@ ramdump.o: ${GENERIC_HFILES} ${REDHAT_HFILES} ramdump.c vmware_vmss.o: ${GENERIC_HFILES} ${VMWARE_HFILES} vmware_vmss.c ${CC} -c ${CRASH_CFLAGS} vmware_vmss.c ${WARNING_OPTIONS} ${WARNING_ERROR} +kaslr_helper.o: ${GENERIC_HFILES} kaslr_helper.c + ${CC} -c ${CRASH_CFLAGS} kaslr_helper.c ${WARNING_OPTIONS} ${WARNING_ERROR} + ${PROGRAM}: force @make --no-print-directory all diff --git a/defs.h b/defs.h index acaad7a..12a1a81 100644 --- a/defs.h +++ b/defs.h @@ -6335,6 +6335,7 @@ FILE *set_sadump_fp(FILE *); void get_sadump_regs(struct bt_info *bt, ulong *ipp, ulong *spp); void sadump_display_regs(int, FILE *); int sadump_phys_base(ulong *); +int sadump_set_phys_base(ulong); void sadump_show_diskset(void); int sadump_is_zero_excluded(void); void sadump_set_zero_excluded(void); @@ -6342,6 +6343,7 @@ void sadump_unset_zero_excluded(void); struct sadump_data; struct sadump_data *get_sadump_data(void); int sadump_calc_kaslr_offset(ulong *); +int sadump_get_cr3_idtr(ulong *, ulong *); /* * qemu.c @@ -6395,6 +6397,11 @@ int vmware_vmss_memory_dump(FILE *); void dump_registers_for_vmss_dump(void); int vmware_vmss_valid_regs(struct bt_info *); +/* + * kaslr_helper.c + */ +int calc_kaslr_offset(ulong *, ulong *); + /* * gnu_binutils.c */ diff --git a/kaslr_helper.c b/kaslr_helper.c new file mode 100644 index 0000000..24b378c --- /dev/null +++ b/kaslr_helper.c @@ -0,0 +1,461 @@ +/* + * kaslr_helper - helper for kaslr offset calculation + * + * Copyright (c) 2011 FUJITSU LIMITED + * Copyright (c) 2018 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * Author: HATAYAMA Daisuke <d.hatayama(a)jp.fujitsu.com&gt; + */ + +#include "defs.h" +#include <elf.h> +#include <inttypes.h> + +#ifdef X86_64 +/* + * Get address of vector0 interrupt handler (Devide Error) from Interrupt + * Descriptor Table. + */ +static ulong +get_vec0_addr(ulong idtr) +{ + struct gate_struct64 { + uint16_t offset_low; + uint16_t segment; + uint32_t ist : 3, zero0 : 5, type : 5, dpl : 2, p : 1; + uint16_t offset_middle; + uint32_t offset_high; + uint32_t zero1; + } __attribute__((packed)) gate; + + readmem(idtr, PHYSADDR, &gate, sizeof(gate), "idt_table", FAULT_ON_ERROR); + + return ((ulong)gate.offset_high << 32) + + ((ulong)gate.offset_middle << 16) + + gate.offset_low; +} + +/* + * Parse a string of [size[KMG] ]offset[KMG] + * Import from Linux kernel(lib/cmdline.c) + */ +static ulong +memparse(char *ptr, char **retptr) +{ + char *endptr; + + unsigned long long ret = strtoull(ptr, &endptr, 0); + + switch (*endptr) { + case 'E': + case 'e': + ret <<= 10; + case 'P': + case 'p': + ret <<= 10; + case 'T': + case 't': + ret <<= 10; + case 'G': + case 'g': + ret <<= 10; + case 'M': + case 'm': + ret <<= 10; + case 'K': + case 'k': + ret <<= 10; + endptr++; + default: + break; + } + + if (retptr) + *retptr = endptr; + + return ret; +} + +/* + * Find "elfcorehdr=" in the boot parameter of kernel and return the address + * of elfcorehdr. + */ +static ulong +get_elfcorehdr(ulong kaslr_offset) +{ + char cmdline[BUFSIZE], *ptr; + ulong cmdline_vaddr; + ulong cmdline_paddr; + ulong buf_vaddr, buf_paddr; + char *end; + ulong elfcorehdr_addr = 0, elfcorehdr_size = 0; + int verbose = CRASHDEBUG(1)? 1: 0; + + cmdline_vaddr = st->saved_command_line_vmlinux + kaslr_offset; + if (!kvtop(NULL, cmdline_vaddr, &cmdline_paddr, verbose)) + return 0; + + if (CRASHDEBUG(1)) { + fprintf(fp, "cmdline vaddr=%lx\n", cmdline_vaddr); + fprintf(fp, "cmdline paddr=%lx\n", cmdline_paddr); + } + + if (!readmem(cmdline_paddr, PHYSADDR, &buf_vaddr, sizeof(ulong), + "saved_command_line", RETURN_ON_ERROR)) + return 0; + + if (!kvtop(NULL, buf_vaddr, &buf_paddr, verbose)) + return 0; + + if (CRASHDEBUG(1)) { + fprintf(fp, "cmdline buffer vaddr=%lx\n", buf_vaddr); + fprintf(fp, "cmdline buffer paddr=%lx\n", buf_paddr); + } + + memset(cmdline, 0, BUFSIZE); + if (!readmem(buf_paddr, PHYSADDR, cmdline, BUFSIZE, + "saved_command_line", RETURN_ON_ERROR)) + return 0; + + ptr = strstr(cmdline, "elfcorehdr="); + if (!ptr) + return 0; + + if (CRASHDEBUG(1)) + fprintf(fp, "2nd kernel detected\n"); + + ptr += strlen("elfcorehdr="); + elfcorehdr_addr = memparse(ptr, &end); + if (*end == '@') { + elfcorehdr_size = elfcorehdr_addr; + elfcorehdr_addr = memparse(end + 1, &end); + } + + if (CRASHDEBUG(1)) { + fprintf(fp, "elfcorehdr_addr=%lx\n", elfcorehdr_addr); + fprintf(fp, "elfcorehdr_size=%lx\n", elfcorehdr_size); + } + + return elfcorehdr_addr; +} + + /* + * Get vmcoreinfo from elfcorehdr. + * Some codes are imported from Linux kernel(fs/proc/vmcore.c) + */ +static int +get_vmcoreinfo(ulong elfcorehdr, ulong *addr, int *len) +{ + unsigned char e_ident[EI_NIDENT]; + Elf64_Ehdr ehdr; + Elf64_Phdr phdr; + Elf64_Nhdr nhdr; + ulong ptr; + ulong nhdr_offset = 0; + int i; + + if (!readmem(elfcorehdr, PHYSADDR, e_ident, EI_NIDENT, + "EI_NIDENT", RETURN_ON_ERROR)) + return FALSE; + + if (e_ident[EI_CLASS] != ELFCLASS64) { + error(INFO, "Only ELFCLASS64 is supportd\n"); + return FALSE; + } + + if (!readmem(elfcorehdr, PHYSADDR, &ehdr, sizeof(ehdr), + "Elf64_Ehdr", RETURN_ON_ERROR)) + return FALSE; + + /* Sanity Check */ + if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0 || + (ehdr.e_type != ET_CORE) || + ehdr.e_ident[EI_CLASS] != ELFCLASS64 || + ehdr.e_ident[EI_VERSION] != EV_CURRENT || + ehdr.e_version != EV_CURRENT || + ehdr.e_ehsize != sizeof(Elf64_Ehdr) || + ehdr.e_phentsize != sizeof(Elf64_Phdr) || + ehdr.e_phnum == 0) { + error(INFO, "Invalid elf header\n"); + return FALSE; + } + + ptr = elfcorehdr + ehdr.e_phoff; + for (i = 0; i < ehdr.e_phnum; i++) { + ulong offset; + char name[16]; + + if (!readmem(ptr, PHYSADDR, &phdr, sizeof(phdr), + "Elf64_Phdr", RETURN_ON_ERROR)) + return FALSE; + + ptr += sizeof(phdr); + if (phdr.p_type != PT_NOTE) + continue; + + offset = phdr.p_offset; + if (!readmem(offset, PHYSADDR, &nhdr, sizeof(nhdr), + "Elf64_Nhdr", RETURN_ON_ERROR)) + return FALSE; + + offset += DIV_ROUND_UP(sizeof(Elf64_Nhdr), sizeof(Elf64_Word))* + sizeof(Elf64_Word); + memset(name, 0, sizeof(name)); + if (!readmem(offset, PHYSADDR, name, sizeof(name), + "Elf64_Nhdr name", RETURN_ON_ERROR)) + return FALSE; + + if(!strcmp(name, "VMCOREINFO")) { + nhdr_offset = offset; + break; + } + } + + if (!nhdr_offset) + return FALSE; + + *addr = nhdr_offset + + DIV_ROUND_UP(nhdr.n_namesz, sizeof(Elf64_Word))* + sizeof(Elf64_Word); + *len = nhdr.n_descsz; + + if (CRASHDEBUG(1)) { + fprintf(fp, "vmcoreinfo addr=%lx\n", *addr); + fprintf(fp, "vmcoreinfo len=%d\n", *len); + } + + return TRUE; +} + +/* + * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd kernel. + * If we are in 2nd kernel, get kaslr_offset/phys_base from vmcoreinfo. + * + * 1. Get command line and try to retrieve "elfcorehdr=" boot parameter + * 2. If "elfcorehdr=" is not found in command line, we are in 1st kernel. + * There is nothing to do. + * 3. If "elfcorehdr=" is found, we are in 2nd kernel. Find vmcoreinfo + * using "elfcorehdr=" and retrieve kaslr_offset/phys_base from vmcoreinfo. + */ +static int +get_kaslr_offset_from_vmcoreinfo(ulong orig_kaslr_offset, + ulong *kaslr_offset, ulong *phys_base) +{ + ulong elfcorehdr_addr = 0; + ulong vmcoreinfo_addr; + int vmcoreinfo_len; + char *buf, *pos; + int ret = FALSE; + + /* Find "elfcorehdr=" in the kernel boot parameter */ + elfcorehdr_addr = get_elfcorehdr(orig_kaslr_offset); + if (!elfcorehdr_addr) + return FALSE; + + /* Get vmcoreinfo from the address of "elfcorehdr=" */ + if (!get_vmcoreinfo(elfcorehdr_addr, &vmcoreinfo_addr, &vmcoreinfo_len)) + return FALSE; + + if (!vmcoreinfo_len) + return FALSE; + + if (CRASHDEBUG(1)) + fprintf(fp, "Find vmcoreinfo in kdump memory\n"); + + buf = GETBUF(vmcoreinfo_len); + if (!readmem(vmcoreinfo_addr, PHYSADDR, buf, vmcoreinfo_len, + "vmcoreinfo", RETURN_ON_ERROR)) + goto quit; + + /* Get phys_base form vmcoreinfo */ + pos = strstr(buf, "NUMBER(phys_base)="); + if (!pos) + goto quit; + *phys_base = strtoull(pos + strlen("NUMBER(phys_base)="), NULL, 0); + + /* Get kaslr_offset form vmcoreinfo */ + pos = strstr(buf, "KERNELOFFSET="); + if (!pos) + goto quit; + *kaslr_offset = strtoull(pos + strlen("KERNELOFFSET="), NULL, 16); + + ret = TRUE; + +quit: + FREEBUF(buf); + return ret; +} + +/* + * Calculate kaslr_offset and phys_base + * + * kaslr_offset: + * The difference between original address in System.map or vmlinux and + * actual address placed randomly by kaslr feature. To be more accurate, + * kaslr_offset = actual address - original address + * + * phys_base: + * Physical address where the kerenel is placed. In other words, it's a + * physical address of __START_KERNEL_map. This is also decided randomly by + * kaslr. + * + * kaslr offset and phys_base are calculated as follows: + * + * kaslr_offset: + * 1) Get IDTR and CR3 value from the dump header. + * 2) Get a virtual address of IDT from IDTR value + * --- (A) + * 3) Translate (A) to physical address using CR3, the upper 52 bits + * of which points a top of page table. + * --- (B) + * 4) Get an address of vector0 (Devide Error) interrupt handler from + * IDT, which are pointed by (B). + * --- (C) + * 5) Get an address of symbol "divide_error" form vmlinux + * --- (D) + * + * Now we have two addresses: + * (C)-> Actual address of "divide_error" + * (D)-> Original address of "divide_error" in the vmlinux + * + * kaslr_offset can be calculated by the difference between these two + * value. + * + * phys_base; + * 1) Get IDT virtual address from vmlinux + * --- (E) + * + * So phys_base can be calculated using relationship of directly mapped + * address. + * + * phys_base = + * Physical address(B) - + * (Virtual address(E) + kaslr_offset - __START_KERNEL_map) + * + * Note that the address (A) cannot be used instead of (E) because (A) is + * not direct map address, it's a fixed map address. + * + * This solution works in most every case, but does not work in the + * following case. + * + * 1) If the dump is captured on early stage of kernel boot, IDTR points + * early IDT table(early_idts) instead of normal IDT(idt_table). + * 2) If the dump is captured whle kdump is working, IDTR points + * IDT table of 2nd kernel, not 1st kernel. + * + * Current implementation does not support the case 1), need + * enhancement in the future. For the case 2), get kaslr_offset and + * phys_base as follows. + * + * 1) Get kaslr_offset and phys_base using the above solution. + * 2) Get kernel boot parameter from "saved_command_line" + * 3) If "elfcorehdr=" is not included in boot parameter, we are in the + * first kernel, nothing to do any more. + * 4) If "elfcorehdr=" is included in boot parameter, we are in the 2nd + * kernel. Retrieve vmcoreinfo from address of "elfcorehdr=" and + * get kaslr_offset and phys_base from vmcoreinfo. + */ +#define PTI_USER_PGTABLE_BIT PAGE_SHIFT +#define PTI_USER_PGTABLE_MASK (1 << PTI_USER_PGTABLE_BIT) +#define CR3_PCID_MASK 0xFFFull +int +calc_kaslr_offset(ulong *kaslr_offset, ulong *phys_base) +{ + uint64_t cr3 = 0, idtr = 0, pgd = 0, idtr_paddr; + ulong divide_error_vmcore; + ulong kaslr_offset_kdump, phys_base_kdump; + int ret = FALSE; + int verbose = CRASHDEBUG(1)? 1: 0; + + if (!machine_type("X86_64")) + return FALSE; + + if (SADUMP_DUMPFILE() && !sadump_get_cr3_idtr(&cr3, &idtr)) { + return FALSE; + } + + if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) + pgd = cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); + else + pgd = cr3 & ~CR3_PCID_MASK; + + /* + * Set up for kvtop. + * + * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some + * variables are not initialized yet. Set up them here to call kvtop(). + * + * TODO: XEN and 5-level is not supported + */ + vt->kernel_pgd[0] = pgd; + machdep->last_pgd_read = vt->kernel_pgd[0]; + machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; + machdep->machspec->pgdir_shift = PGDIR_SHIFT; + machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; + if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), + "pgd", RETURN_ON_ERROR)) + goto quit; + + /* Convert virtual address of IDT table to physical address */ + if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) + goto quit; + + /* Now we can calculate kaslr_offset and phys_base */ + divide_error_vmcore = get_vec0_addr(idtr_paddr); + *kaslr_offset = divide_error_vmcore - st->divide_error_vmlinux; + *phys_base = idtr_paddr - + (st->idt_table_vmlinux + *kaslr_offset - __START_KERNEL_map); + + if (CRASHDEBUG(1)) { + fprintf(fp, "calc_kaslr_offset: idtr=%lx\n", idtr); + fprintf(fp, "calc_kaslr_offset: pgd=%lx\n", pgd); + fprintf(fp, "calc_kaslr_offset: idtr(phys)=%lx\n", idtr_paddr); + fprintf(fp, "calc_kaslr_offset: divide_error(vmlinux): %lx\n", + st->divide_error_vmlinux); + fprintf(fp, "calc_kaslr_offset: divide_error(vmcore): %lx\n", + divide_error_vmcore); + } + + /* + * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd + * kernel. If we are in 2nd kernel, get kaslr_offset/phys_base + * from vmcoreinfo + */ + if (get_kaslr_offset_from_vmcoreinfo( + *kaslr_offset, &kaslr_offset_kdump, &phys_base_kdump)) { + *kaslr_offset = kaslr_offset_kdump; + *phys_base = phys_base_kdump; + } else if (CRASHDEBUG(1)) { + fprintf(fp, "kaslr_helper: failed to determine which kernel was running at crash,\n"); + fprintf(fp, "kaslr_helper: asssuming the kdump 1st kernel.\n"); + } + + if (CRASHDEBUG(1)) { + fprintf(fp, "calc_kaslr_offset: kaslr_offset=%lx\n", + *kaslr_offset); + fprintf(fp, "calc_kaslr_offset: phys_base=%lx\n", *phys_base); + } + + ret = TRUE; +quit: + vt->kernel_pgd[0] = 0; + machdep->last_pgd_read = 0; + return ret; +} +#else +int +calc_kaslr_offset(ulong *kaslr_offset, ulong *phys_page) +{ + return FALSE; +} +#endif /* X86_64 */ diff --git a/sadump.c b/sadump.c index d19b40a..35f7cf0 100644 --- a/sadump.c +++ b/sadump.c @@ -1569,6 +1569,14 @@ int sadump_phys_base(ulong *phys_base) return FALSE; } +int +sadump_set_phys_base(ulong phys_base) +{ + sd->phys_base = phys_base; + + return TRUE; +} + /* * Used by "sys" command to show diskset disk names. */ @@ -1656,466 +1664,42 @@ get_sadump_data(void) static int get_sadump_smram_cpu_state_any(struct sadump_smram_cpu_state *smram) { - ulong offset; - struct sadump_header *sh = sd->dump_header; - int apicid; - struct sadump_smram_cpu_state scs, zero; - - offset = sd->sub_hdr_offset + sizeof(uint32_t) + - sd->dump_header->nr_cpus * sizeof(struct sadump_apic_state); - - memset(&zero, 0, sizeof(zero)); - - for (apicid = 0; apicid < sh->nr_cpus; ++apicid) { - if (!read_device(&scs, sizeof(scs), &offset)) { - error(INFO, "sadump: cannot read sub header " - "cpu_state\n"); - return FALSE; - } - if (memcmp(&scs, &zero, sizeof(scs)) != 0) { - *smram = scs; - return TRUE; - } - } - - return FALSE; -} - -/* - * Get address of vector0 interrupt handler (Devide Error) from Interrupt - * Descriptor Table. - */ -static ulong -get_vec0_addr(ulong idtr) -{ - struct gate_struct64 { - uint16_t offset_low; - uint16_t segment; - uint32_t ist : 3, zero0 : 5, type : 5, dpl : 2, p : 1; - uint16_t offset_middle; - uint32_t offset_high; - uint32_t zero1; - } __attribute__((packed)) gate; - - readmem(idtr, PHYSADDR, &gate, sizeof(gate), "idt_table", FAULT_ON_ERROR); - - return ((ulong)gate.offset_high << 32) - + ((ulong)gate.offset_middle << 16) - + gate.offset_low; -} - -/* - * Parse a string of [size[KMG] ]offset[KMG] - * Import from Linux kernel(lib/cmdline.c) - */ -static ulong memparse(char *ptr, char **retptr) -{ - char *endptr; - - unsigned long long ret = strtoull(ptr, &endptr, 0); - - switch (*endptr) { - case 'E': - case 'e': - ret <<= 10; - case 'P': - case 'p': - ret <<= 10; - case 'T': - case 't': - ret <<= 10; - case 'G': - case 'g': - ret <<= 10; - case 'M': - case 'm': - ret <<= 10; - case 'K': - case 'k': - ret <<= 10; - endptr++; - default: - break; - } - - if (retptr) - *retptr = endptr; - - return ret; -} - -/* - * Find "elfcorehdr=" in the boot parameter of kernel and return the address - * of elfcorehdr. - */ -static ulong -get_elfcorehdr(ulong kaslr_offset) -{ - char cmdline[BUFSIZE], *ptr; - ulong cmdline_vaddr; - ulong cmdline_paddr; - ulong buf_vaddr, buf_paddr; - char *end; - ulong elfcorehdr_addr = 0, elfcorehdr_size = 0; - int verbose = CRASHDEBUG(1)? 1: 0; - - cmdline_vaddr = st->saved_command_line_vmlinux + kaslr_offset; - if (!kvtop(NULL, cmdline_vaddr, &cmdline_paddr, verbose)) - return 0; - - if (CRASHDEBUG(1)) { - fprintf(fp, "cmdline vaddr=%lx\n", cmdline_vaddr); - fprintf(fp, "cmdline paddr=%lx\n", cmdline_paddr); - } - - if (!readmem(cmdline_paddr, PHYSADDR, &buf_vaddr, sizeof(ulong), - "saved_command_line", RETURN_ON_ERROR)) - return 0; - - if (!kvtop(NULL, buf_vaddr, &buf_paddr, verbose)) - return 0; - - if (CRASHDEBUG(1)) { - fprintf(fp, "cmdline buffer vaddr=%lx\n", buf_vaddr); - fprintf(fp, "cmdline buffer paddr=%lx\n", buf_paddr); - } - - memset(cmdline, 0, BUFSIZE); - if (!readmem(buf_paddr, PHYSADDR, cmdline, BUFSIZE, - "saved_command_line", RETURN_ON_ERROR)) - return 0; - - ptr = strstr(cmdline, "elfcorehdr="); - if (!ptr) - return 0; - - if (CRASHDEBUG(1)) - fprintf(fp, "2nd kernel detected\n"); - - ptr += strlen("elfcorehdr="); - elfcorehdr_addr = memparse(ptr, &end); - if (*end == '@') { - elfcorehdr_size = elfcorehdr_addr; - elfcorehdr_addr = memparse(end + 1, &end); - } - - if (CRASHDEBUG(1)) { - fprintf(fp, "elfcorehdr_addr=%lx\n", elfcorehdr_addr); - fprintf(fp, "elfcorehdr_size=%lx\n", elfcorehdr_size); - } - - return elfcorehdr_addr; -} - - /* - * Get vmcoreinfo from elfcorehdr. - * Some codes are imported from Linux kernel(fs/proc/vmcore.c) - */ -static int -get_vmcoreinfo(ulong elfcorehdr, ulong *addr, int *len) -{ - unsigned char e_ident[EI_NIDENT]; - Elf64_Ehdr ehdr; - Elf64_Phdr phdr; - Elf64_Nhdr nhdr; - ulong ptr; - ulong nhdr_offset = 0; - int i; - - if (!readmem(elfcorehdr, PHYSADDR, e_ident, EI_NIDENT, - "EI_NIDENT", RETURN_ON_ERROR)) - return FALSE; - - if (e_ident[EI_CLASS] != ELFCLASS64) { - error(INFO, "Only ELFCLASS64 is supportd\n"); - return FALSE; - } - - if (!readmem(elfcorehdr, PHYSADDR, &ehdr, sizeof(ehdr), - "Elf64_Ehdr", RETURN_ON_ERROR)) - return FALSE; - - /* Sanity Check */ - if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0 || - (ehdr.e_type != ET_CORE) || - ehdr.e_ident[EI_CLASS] != ELFCLASS64 || - ehdr.e_ident[EI_VERSION] != EV_CURRENT || - ehdr.e_version != EV_CURRENT || - ehdr.e_ehsize != sizeof(Elf64_Ehdr) || - ehdr.e_phentsize != sizeof(Elf64_Phdr) || - ehdr.e_phnum == 0) { - error(INFO, "Invalid elf header\n"); - return FALSE; - } - - ptr = elfcorehdr + ehdr.e_phoff; - for (i = 0; i < ehdr.e_phnum; i++) { - ulong offset; - char name[16]; - - if (!readmem(ptr, PHYSADDR, &phdr, sizeof(phdr), - "Elf64_Phdr", RETURN_ON_ERROR)) - return FALSE; - - ptr += sizeof(phdr); - if (phdr.p_type != PT_NOTE) - continue; - - offset = phdr.p_offset; - if (!readmem(offset, PHYSADDR, &nhdr, sizeof(nhdr), - "Elf64_Nhdr", RETURN_ON_ERROR)) - return FALSE; - - offset += DIV_ROUND_UP(sizeof(Elf64_Nhdr), sizeof(Elf64_Word))* - sizeof(Elf64_Word); - memset(name, 0, sizeof(name)); - if (!readmem(offset, PHYSADDR, name, sizeof(name), - "Elf64_Nhdr name", RETURN_ON_ERROR)) - return FALSE; - - if(!strcmp(name, "VMCOREINFO")) { - nhdr_offset = offset; - break; - } - } - - if (!nhdr_offset) - return FALSE; - - *addr = nhdr_offset + - DIV_ROUND_UP(nhdr.n_namesz, sizeof(Elf64_Word))* - sizeof(Elf64_Word); - *len = nhdr.n_descsz; - - if (CRASHDEBUG(1)) { - fprintf(fp, "vmcoreinfo addr=%lx\n", *addr); - fprintf(fp, "vmcoreinfo len=%d\n", *len); - } - - return TRUE; -} - -/* - * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd kernel. - * If we are in 2nd kernel, get kaslr_offset/phys_base from vmcoreinfo. - * - * 1. Get command line and try to retrieve "elfcorehdr=" boot parameter - * 2. If "elfcorehdr=" is not found in command line, we are in 1st kernel. - * There is nothing to do. - * 3. If "elfcorehdr=" is found, we are in 2nd kernel. Find vmcoreinfo - * using "elfcorehdr=" and retrieve kaslr_offset/phys_base from vmcoreinfo. - */ -static int -get_kaslr_offset_from_vmcoreinfo(ulong orig_kaslr_offset, - ulong *kaslr_offset, ulong *phys_base) -{ - ulong elfcorehdr_addr = 0; - ulong vmcoreinfo_addr; - int vmcoreinfo_len; - char *buf, *pos; - int ret = FALSE; - - /* Find "elfcorehdr=" in the kernel boot parameter */ - elfcorehdr_addr = get_elfcorehdr(orig_kaslr_offset); - if (!elfcorehdr_addr) - return FALSE; - - /* Get vmcoreinfo from the address of "elfcorehdr=" */ - if (!get_vmcoreinfo(elfcorehdr_addr, &vmcoreinfo_addr, &vmcoreinfo_len)) - return FALSE; - - if (!vmcoreinfo_len) - return FALSE; - - if (CRASHDEBUG(1)) - fprintf(fp, "Find vmcoreinfo in kdump memory\n"); - - buf = GETBUF(vmcoreinfo_len); - if (!readmem(vmcoreinfo_addr, PHYSADDR, buf, vmcoreinfo_len, - "vmcoreinfo", RETURN_ON_ERROR)) - goto quit; - - /* Get phys_base form vmcoreinfo */ - pos = strstr(buf, "NUMBER(phys_base)="); - if (!pos) - goto quit; - *phys_base = strtoull(pos + strlen("NUMBER(phys_base)="), NULL, 0); - - /* Get kaslr_offset form vmcoreinfo */ - pos = strstr(buf, "KERNELOFFSET="); - if (!pos) - goto quit; - *kaslr_offset = strtoull(pos + strlen("KERNELOFFSET="), NULL, 16); - - ret = TRUE; - -quit: - FREEBUF(buf); - return ret; + ulong offset; + struct sadump_header *sh = sd->dump_header; + int apicid; + struct sadump_smram_cpu_state scs, zero; + + offset = sd->sub_hdr_offset + sizeof(uint32_t) + + sd->dump_header->nr_cpus * sizeof(struct sadump_apic_state); + + memset(&zero, 0, sizeof(zero)); + + for (apicid = 0; apicid < sh->nr_cpus; ++apicid) { + if (!read_device(&scs, sizeof(scs), &offset)) { + error(INFO, "sadump: cannot read sub header " + "cpu_state\n"); + return FALSE; + } + if (memcmp(&scs, &zero, sizeof(scs)) != 0) { + *smram = scs; + return TRUE; + } + } + + return FALSE; } -/* - * Calculate kaslr_offset and phys_base - * - * kaslr_offset: - * The difference between original address in System.map or vmlinux and - * actual address placed randomly by kaslr feature. To be more accurate, - * kaslr_offset = actual address - original address - * - * phys_base: - * Physical address where the kerenel is placed. In other words, it's a - * physical address of __START_KERNEL_map. This is also decided randomly by - * kaslr. - * - * kaslr offset and phys_base are calculated as follows: - * - * kaslr_offset: - * 1) Get IDTR and CR3 value from the dump header. - * 2) Get a virtual address of IDT from IDTR value - * --- (A) - * 3) Translate (A) to physical address using CR3, the upper 52 bits - * of which points a top of page table. - * --- (B) - * 4) Get an address of vector0 (Devide Error) interrupt handler from - * IDT, which are pointed by (B). - * --- (C) - * 5) Get an address of symbol "divide_error" form vmlinux - * --- (D) - * - * Now we have two addresses: - * (C)-> Actual address of "divide_error" - * (D)-> Original address of "divide_error" in the vmlinux - * - * kaslr_offset can be calculated by the difference between these two - * value. - * - * phys_base; - * 1) Get IDT virtual address from vmlinux - * --- (E) - * - * So phys_base can be calculated using relationship of directly mapped - * address. - * - * phys_base = - * Physical address(B) - - * (Virtual address(E) + kaslr_offset - __START_KERNEL_map) - * - * Note that the address (A) cannot be used instead of (E) because (A) is - * not direct map address, it's a fixed map address. - * - * This solution works in most every case, but does not work in the - * following case. - * - * 1) If the dump is captured on early stage of kernel boot, IDTR points - * early IDT table(early_idts) instead of normal IDT(idt_table). - * 2) If the dump is captured whle kdump is working, IDTR points - * IDT table of 2nd kernel, not 1st kernel. - * - * Current implementation does not support the case 1), need - * enhancement in the future. For the case 2), get kaslr_offset and - * phys_base as follows. - * - * 1) Get kaslr_offset and phys_base using the above solution. - * 2) Get kernel boot parameter from "saved_command_line" - * 3) If "elfcorehdr=" is not included in boot parameter, we are in the - * first kernel, nothing to do any more. - * 4) If "elfcorehdr=" is included in boot parameter, we are in the 2nd - * kernel. Retrieve vmcoreinfo from address of "elfcorehdr=" and - * get kaslr_offset and phys_base from vmcoreinfo. - */ -#define PTI_USER_PGTABLE_BIT PAGE_SHIFT -#define PTI_USER_PGTABLE_MASK (1 << PTI_USER_PGTABLE_BIT) -#define CR3_PCID_MASK 0xFFFull int -sadump_calc_kaslr_offset(ulong *kaslr_offset) +sadump_get_cr3_idtr(ulong *cr3, ulong *idtr) { - ulong phys_base = 0; struct sadump_smram_cpu_state scs; - uint64_t idtr = 0, pgd = 0, idtr_paddr; - ulong divide_error_vmcore; - ulong kaslr_offset_kdump, phys_base_kdump; - int ret = FALSE; - int verbose = CRASHDEBUG(1)? 1: 0; - - if (!machine_type("X86_64")) - return FALSE; memset(&scs, 0, sizeof(scs)); get_sadump_smram_cpu_state_any(&scs); - if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) - pgd = scs.Cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); - else - pgd = scs.Cr3 & ~CR3_PCID_MASK; - idtr = ((uint64_t)scs.IdtUpper)<<32 | (uint64_t)scs.IdtLower; - /* - * Set up for kvtop. - * - * calc_kaslr_offset() is called before machdep_init(PRE_GDB), so some - * variables are not initialized yet. Set up them here to call kvtop(). - * - * TODO: XEN and 5-level is not supported - */ - vt->kernel_pgd[0] = pgd; - machdep->last_pgd_read = vt->kernel_pgd[0]; - machdep->machspec->physical_mask_shift = __PHYSICAL_MASK_SHIFT_2_6; - machdep->machspec->pgdir_shift = PGDIR_SHIFT; - machdep->machspec->ptrs_per_pgd = PTRS_PER_PGD; - if (!readmem(pgd, PHYSADDR, machdep->pgd, PAGESIZE(), - "pgd", RETURN_ON_ERROR)) - goto quit; - - /* Convert virtual address of IDT table to physical address */ - if (!kvtop(NULL, idtr, &idtr_paddr, verbose)) - goto quit; - - /* Now we can calculate kaslr_offset and phys_base */ - divide_error_vmcore = get_vec0_addr(idtr_paddr); - *kaslr_offset = divide_error_vmcore - st->divide_error_vmlinux; - phys_base = idtr_paddr - - (st->idt_table_vmlinux + *kaslr_offset - __START_KERNEL_map); - - if (CRASHDEBUG(1)) { - fprintf(fp, "calc_kaslr_offset: idtr=%lx\n", idtr); - fprintf(fp, "calc_kaslr_offset: pgd=%lx\n", pgd); - fprintf(fp, "calc_kaslr_offset: idtr(phys)=%lx\n", idtr_paddr); - fprintf(fp, "calc_kaslr_offset: divide_error(vmlinux): %lx\n", - st->divide_error_vmlinux); - fprintf(fp, "calc_kaslr_offset: divide_error(vmcore): %lx\n", - divide_error_vmcore); - } - - /* - * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd - * kernel. If we are in 2nd kernel, get kaslr_offset/phys_base - * from vmcoreinfo - */ - if (get_kaslr_offset_from_vmcoreinfo( - *kaslr_offset, &kaslr_offset_kdump, &phys_base_kdump)) { - *kaslr_offset = kaslr_offset_kdump; - phys_base = phys_base_kdump; - } else if (CRASHDEBUG(1)) { - fprintf(fp, "sadump: failed to determine which kernel was running at crash,\n"); - fprintf(fp, "sadump: asssuming the kdump 1st kernel.\n"); - } + *cr3 = scs.Cr3; + *idtr = ((uint64_t)scs.IdtUpper)<<32 | (uint64_t)scs.IdtLower; - if (CRASHDEBUG(1)) { - fprintf(fp, "calc_kaslr_offset: kaslr_offset=%lx\n", - *kaslr_offset); - fprintf(fp, "calc_kaslr_offset: phys_base=%lx\n", phys_base); - } - - sd->phys_base = phys_base; - ret = TRUE; -quit: - vt->kernel_pgd[0] = 0; - machdep->last_pgd_read = 0; - return ret; -} -#else -int -sadump_calc_kaslr_offset(ulong *kaslr_offset) -{ - return FALSE; + return TRUE; } #endif /* X86_64 */ diff --git a/symbols.c b/symbols.c index 7910f53..54aa5b2 100644 --- a/symbols.c +++ b/symbols.c @@ -642,14 +642,18 @@ derive_kaslr_offset(bfd *abfd, int dynamic, bfd_byte *start, bfd_byte *end, if (SADUMP_DUMPFILE()) { ulong kaslr_offset = 0; + ulong phys_base = 0; - sadump_calc_kaslr_offset(&kaslr_offset); + calc_kaslr_offset(&kaslr_offset, &phys_base); if (kaslr_offset) { kt->relocate = kaslr_offset * -1; kt->flags |= RELOC_SET; } + if (phys_base) + sadump_set_phys_base(phys_base); + return; } -- 2.14.3

If a QEMU ELF dump from a KASLR-enabled kernel is missing the vmcoreinfo data, try to calculate phys_base and kaslr_offset by using the technique developed by Takao Indoh. --- defs.h | 7 +++++++ kaslr_helper.c | 25 +++++++++++++++++++++++-- netdump.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ netdump.h | 1 + symbols.c | 20 ++++++++++++++------ x86_64.c | 17 +++++++++++++++-- 6 files changed, 117 insertions(+), 10 deletions(-) diff --git a/defs.h b/defs.h index 45e9069..b117c4a 100644 --- a/defs.h +++ b/defs.h @@ -284,6 +284,9 @@ struct number_option { #define KVMDUMP_DUMPFILE() (pc->flags & KVMDUMP) #define SADUMP_DUMPFILE() (pc->flags & SADUMP) #define VMSS_DUMPFILE() (pc->flags & VMWARE_VMSS) +#define QEMU_MEM_DUMP_NO_VMCOREINFO() \ + ((pc->flags2 & (QEMU_MEM_DUMP_ELF)) && !(pc->flags2 & VMCOREINFO)) + #define NETDUMP_LOCAL (0x1) /* netdump_data flags */ #define NETDUMP_REMOTE (0x2) @@ -6227,6 +6230,8 @@ int get_netdump_arch(void); int exist_regs_in_elf_notes(struct task_context *); void *get_regs_from_elf_notes(struct task_context *); void map_cpus_to_prstatus(void); +int kdump_phys_base(ulong *); +int kdump_set_phys_base(ulong); int arm_kdump_phys_base(ulong *); int is_proc_kcore(char *, ulong); int proc_kcore_init(FILE *); @@ -6238,6 +6243,8 @@ void kdump_backup_region_init(void); void display_regs_from_elf_notes(int, FILE *); void display_ELF_note(int, int, void *, FILE *); void *netdump_get_prstatus_percpu(int); +int kdump_kaslr_check(void); +QEMUCPUState *kdump_get_qemucpustate(int); #define PRSTATUS_NOTE (1) #define QEMU_NOTE (2) diff --git a/kaslr_helper.c b/kaslr_helper.c index 24b378c..9f04e3b 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -237,6 +237,22 @@ get_vmcoreinfo(ulong elfcorehdr, ulong *addr, int *len) return TRUE; } +static int +qemu_get_cr3_idtr(ulong *cr3, ulong *idtr) +{ + QEMUCPUState *cpustat; + + cpustat = kdump_get_qemucpustate(0); + if (!cpustat) { + return FALSE; + } + + *cr3 = cpustat->cr[3]; + *idtr = cpustat->idt.base; + + return TRUE; +} + /* * Check if current kaslr_offset/phys_base is for 1st kernel or 2nd kernel. * If we are in 2nd kernel, get kaslr_offset/phys_base from vmcoreinfo. @@ -380,9 +396,14 @@ calc_kaslr_offset(ulong *kaslr_offset, ulong *phys_base) if (!machine_type("X86_64")) return FALSE; - if (SADUMP_DUMPFILE() && !sadump_get_cr3_idtr(&cr3, &idtr)) { + if (SADUMP_DUMPFILE()) { + if (!sadump_get_cr3_idtr(&cr3, &idtr)) + return FALSE; + } else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) { + if (!qemu_get_cr3_idtr(&cr3, &idtr)) + return FALSE; + } else return FALSE; - } if (st->pti_init_vmlinux || st->kaiser_init_vmlinux) pgd = cr3 & ~(CR3_PCID_MASK|PTI_USER_PGTABLE_MASK); diff --git a/netdump.c b/netdump.c index 6cf7ca8..136f889 100644 --- a/netdump.c +++ b/netdump.c @@ -3999,6 +3999,28 @@ no_nt_prstatus_exists: return pt_regs; } +int +kdump_phys_base(ulong *phys_base) +{ + if (!kdump_kaslr_check()) + return FALSE; + + *phys_base = nd->phys_base; + + return TRUE; +} + +int +kdump_set_phys_base(ulong phys_base) +{ + if (!kdump_kaslr_check()) + return FALSE; + + nd->phys_base = phys_base; + + return TRUE; +} + /* * In case of ARM we need to determine correct PHYS_OFFSET from the kdump file. * This is done by taking lowest physical address (LMA) from given load @@ -4713,3 +4735,38 @@ error(INFO, "%s: backup region is used: %llx\n", typename, backup_offset + total error: error(WARNING, "failed to init kexec backup region\n"); } + +int +kdump_kaslr_check(void) +{ + if (!QEMU_MEM_DUMP_NO_VMCOREINFO()) + return FALSE; + + /* If vmcore has QEMU note, need to calculate kaslr offset */ + if (nd->num_qemu_notes) + return TRUE; + else + return FALSE; +} + +#ifdef X86_64 +QEMUCPUState * +kdump_get_qemucpustate(int cpu) +{ + if (cpu >= nd->num_qemu_notes) { + if (CRASHDEBUG(1)) + error(INFO, + "Invalid index for QEMU Note: %d (>= %d)\n", + cpu, nd->num_qemu_notes); + return NULL; + } + + if (!nd->elf64 || (nd->elf64->e_machine != EM_X86_64)) { + if (CRASHDEBUG(1)) + error(INFO, "Only x86_64 64bit is supported.\n"); + return NULL; + } + + return (QEMUCPUState *)nd->nt_qemu_percpu[cpu]; +} +#endif diff --git a/netdump.h b/netdump.h index 87d51ca..5474593 100644 --- a/netdump.h +++ b/netdump.h @@ -78,6 +78,7 @@ struct vmcore_data { ulong backup_src_size; ulonglong backup_offset; ulong arch_data; + ulong phys_base; }; #define DUMP_ELF_INCOMPLETE 0x1 /* dumpfile is incomplete */ diff --git a/symbols.c b/symbols.c index 54aa5b2..348d9ae 100644 --- a/symbols.c +++ b/symbols.c @@ -610,7 +610,11 @@ kaslr_init(void) st->_stext_vmlinux = UNINITIALIZED; } - if (KDUMP_DUMPFILE() || DISKDUMP_DUMPFILE()) { + if (QEMU_MEM_DUMP_NO_VMCOREINFO()) { + if (KDUMP_DUMPFILE() && kdump_kaslr_check()) { + kt->flags2 |= KASLR_CHECK; + } + } else if (KDUMP_DUMPFILE() || DISKDUMP_DUMPFILE()) { if ((string = pc->read_vmcoreinfo("SYMBOL(_stext)"))) { kt->vmcoreinfo._stext_SYMBOL = htol(string, RETURN_ON_ERROR, NULL); @@ -640,7 +644,7 @@ derive_kaslr_offset(bfd *abfd, int dynamic, bfd_byte *start, bfd_byte *end, unsigned long relocate; ulong _stext_relocated; - if (SADUMP_DUMPFILE()) { + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) { ulong kaslr_offset = 0; ulong phys_base = 0; @@ -651,8 +655,12 @@ derive_kaslr_offset(bfd *abfd, int dynamic, bfd_byte *start, bfd_byte *end, kt->flags |= RELOC_SET; } - if (phys_base) - sadump_set_phys_base(phys_base); + if (phys_base) { + if (SADUMP_DUMPFILE()) + sadump_set_phys_base(phys_base); + else if (KDUMP_DUMPFILE()) + kdump_set_phys_base(phys_base); + } return; } @@ -3071,7 +3079,7 @@ dump_symbol_table(void) else fprintf(fp, "\n"); - if (SADUMP_DUMPFILE()) { + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) { fprintf(fp, "divide_error_vmlinux: %lx\n", st->divide_error_vmlinux); fprintf(fp, " idt_table_vmlinux: %lx\n", st->idt_table_vmlinux); fprintf(fp, "saved_command_line_vmlinux: %lx\n", st->saved_command_line_vmlinux); @@ -12298,7 +12306,7 @@ numeric_forward(const void *P_x, const void *P_y) } } - if (SADUMP_DUMPFILE()) { + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) { /* Need for kaslr_offset and phys_base */ if (STREQ(x->name, "divide_error")) st->divide_error_vmlinux = valueof(x); diff --git a/x86_64.c b/x86_64.c index aaa0de6..4affc67 100644 --- a/x86_64.c +++ b/x86_64.c @@ -202,7 +202,7 @@ x86_64_init(int when) machdep->machspec->kernel_image_size = dtol(string, QUIET, NULL); free(string); } - if (SADUMP_DUMPFILE()) + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) /* Need for calculation of kaslr_offset and phys_base */ machdep->kvtop = x86_64_kvtop; break; @@ -2220,7 +2220,8 @@ x86_64_kvtop(struct task_context *tc, ulong kvaddr, physaddr_t *paddr, int verbo ulong pte; physaddr_t physpage; - if (SADUMP_DUMPFILE() && !(machdep->flags & KSYMS_START)) { + if ((SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) + && !(machdep->flags & KSYMS_START)) { /* * In the case of sadump, to calculate kaslr_offset and * phys_base, kvtop is called during symtab_init(). In this @@ -6640,6 +6641,18 @@ x86_64_calc_phys_base(void) * Get relocation value from whatever dumpfile format is being used. */ + if (QEMU_MEM_DUMP_NO_VMCOREINFO()) { + if (KDUMP_DUMPFILE() && kdump_phys_base(&phys_base)) + machdep->machspec->phys_base = phys_base; + + if (!x86_64_virt_phys_base()) + error(WARNING, + "cannot determine physical base address:" + " defaulting to %lx\n\n", + machdep->machspec->phys_base); + return; + } + if (DISKDUMP_DUMPFILE()) { if (diskdump_phys_base(&phys_base)) { machdep->machspec->phys_base = phys_base; -- 2.14.3

VMware does not provide support for saving and including the vmcoreinfo data into a VM dump. This patch adds support for calculating phys_base and kaslr_offset for KASLR-enabled kernels, using the technique developed by Takao Indoh. --- defs.h | 3 +++ kaslr_helper.c | 3 +++ symbols.c | 10 ++++++---- vmware_vmss.c | 28 ++++++++++++++++++++++++++++ vmware_vmss.h | 1 + x86_64.c | 20 ++++++++++++++++++-- 6 files changed, 59 insertions(+), 6 deletions(-) diff --git a/defs.h b/defs.h index ba2e5e1..3a3b6f6 100644 --- a/defs.h +++ b/defs.h @@ -6429,6 +6429,9 @@ void get_vmware_vmss_regs(struct bt_info *, ulong *, ulong *); int vmware_vmss_memory_dump(FILE *); void dump_registers_for_vmss_dump(void); int vmware_vmss_valid_regs(struct bt_info *); +int vmware_vmss_get_cr3_idtr(ulong *, ulong *); +int vmware_vmss_phys_base(ulong *phys_base); +int vmware_vmss_set_phys_base(ulong); /* * kaslr_helper.c diff --git a/kaslr_helper.c b/kaslr_helper.c index 168cfb9..8a1fede 100644 --- a/kaslr_helper.c +++ b/kaslr_helper.c @@ -409,6 +409,9 @@ calc_kaslr_offset(ulong *kaslr_offset, ulong *phys_base) } else if (QEMU_MEM_DUMP_NO_VMCOREINFO()) { if (!qemu_get_cr3_idtr(&cr3, &idtr)) return FALSE; + } else if (VMSS_DUMPFILE()) { + if (!vmware_vmss_get_cr3_idtr(&cr3, &idtr)) + return FALSE; } else return FALSE; diff --git a/symbols.c b/symbols.c index ddbce7d..638800a 100644 --- a/symbols.c +++ b/symbols.c @@ -631,7 +631,7 @@ kaslr_init(void) } } - if (SADUMP_DUMPFILE()) + if (SADUMP_DUMPFILE() || VMSS_DUMPFILE()) kt->flags2 |= KASLR_CHECK; } @@ -646,7 +646,7 @@ derive_kaslr_offset(bfd *abfd, int dynamic, bfd_byte *start, bfd_byte *end, unsigned long relocate; ulong _stext_relocated; - if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) { + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || VMSS_DUMPFILE()) { ulong kaslr_offset = 0; ulong phys_base = 0; @@ -664,6 +664,8 @@ derive_kaslr_offset(bfd *abfd, int dynamic, bfd_byte *start, bfd_byte *end, kdump_set_phys_base(phys_base); else if (DISKDUMP_DUMPFILE()) diskdump_set_phys_base(phys_base); + else if (VMSS_DUMPFILE()) + vmware_vmss_set_phys_base(phys_base); } return; @@ -3083,7 +3085,7 @@ dump_symbol_table(void) else fprintf(fp, "\n"); - if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) { + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || VMSS_DUMPFILE()) { fprintf(fp, "divide_error_vmlinux: %lx\n", st->divide_error_vmlinux); fprintf(fp, " idt_table_vmlinux: %lx\n", st->idt_table_vmlinux); fprintf(fp, "saved_command_line_vmlinux: %lx\n", st->saved_command_line_vmlinux); @@ -12310,7 +12312,7 @@ numeric_forward(const void *P_x, const void *P_y) } } - if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) { + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || VMSS_DUMPFILE()) { /* Need for kaslr_offset and phys_base */ if (STREQ(x->name, "divide_error")) st->divide_error_vmlinux = valueof(x); diff --git a/vmware_vmss.c b/vmware_vmss.c index ad577b2..74c7483 100644 --- a/vmware_vmss.c +++ b/vmware_vmss.c @@ -863,3 +863,31 @@ vmware_vmss_valid_regs(struct bt_info *bt) return FALSE; } + +int +vmware_vmss_get_cr3_idtr(ulong *cr3, ulong *idtr) +{ + if (vmss.num_vcpus == 0 || vmss.vcpu_regs[0] != REGS_PRESENT_ALL) + return FALSE; + + *cr3 = vmss.regs64[0]->cr[3]; + *idtr = vmss.regs64[0]->idtr; + + return TRUE; +} + +int +vmware_vmss_phys_base(ulong *phys_base) +{ + *phys_base = vmss.phys_base; + + return TRUE; +} + +int +vmware_vmss_set_phys_base(ulong phys_base) +{ + vmss.phys_base = phys_base; + + return TRUE; +} diff --git a/vmware_vmss.h b/vmware_vmss.h index f6966a5..a5828a0 100644 --- a/vmware_vmss.h +++ b/vmware_vmss.h @@ -157,6 +157,7 @@ struct vmssdata { memregion regions[MAX_REGIONS]; uint64_t memoffset; uint64_t memsize; + ulong phys_base; int separate_vmem; uint32_t *vcpu_regs; uint64_t num_vcpus; diff --git a/x86_64.c b/x86_64.c index e46e70f..2934f80 100644 --- a/x86_64.c +++ b/x86_64.c @@ -202,7 +202,8 @@ x86_64_init(int when) machdep->machspec->kernel_image_size = dtol(string, QUIET, NULL); free(string); } - if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) + if (SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || + VMSS_DUMPFILE()) /* Need for calculation of kaslr_offset and phys_base */ machdep->kvtop = x86_64_kvtop; break; @@ -2220,7 +2221,7 @@ x86_64_kvtop(struct task_context *tc, ulong kvaddr, physaddr_t *paddr, int verbo ulong pte; physaddr_t physpage; - if ((SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO()) + if ((SADUMP_DUMPFILE() || QEMU_MEM_DUMP_NO_VMCOREINFO() || VMSS_DUMPFILE()) && !(machdep->flags & KSYMS_START)) { /* * In the case of sadump, to calculate kaslr_offset and @@ -6654,6 +6655,21 @@ x86_64_calc_phys_base(void) return; } + if (VMSS_DUMPFILE()) { + if (vmware_vmss_phys_base(&phys_base)) { + machdep->machspec->phys_base = phys_base; + if (!x86_64_virt_phys_base()) + error(WARNING, + "cannot determine physical base address:" + " defaulting to %lx\n\n", + machdep->machspec->phys_base); + if (CRASHDEBUG(1)) + fprintf(fp, "compressed kdump: phys_base: %lx\n", + phys_base); + } + return; + } + if (DISKDUMP_DUMPFILE()) { if (diskdump_phys_base(&phys_base)) { machdep->machspec->phys_base = phys_base; -- 2.14.3